Compute Engine, Cloud Run, GKE, and App Engine standard or flexible are different PHP supply chains.
Identify the runtime
Identify which product serves the hostname. Cloud Run and GKE are image digests. App Engine standard is Google’s runtime version. A VM is the guest OS package.
Change and verify
Follow that product’s update path. Rebuild images for Cloud Run and GKE. For App Engine, select a runtime Google has updated and read their release note. No Google runtime version is asserted on this page because none was opened in the 22 October 2026 review.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.