On Oct 21, 2026, China’s National Information Security Vulnerability Sharing Platform (CNVD) recorded two PHP remote code execution vulnerabilities (CNVD-2026-41674, CNVD-2026-41675; corresponding to CVE-2026-109618, CVE-2026-109619). Unauthenticated remote attackers can craft malicious HTTP requests that trigger memory errors and, under certain conditions, achieve denial of service, sensitive data theft, or remote code execution on affected servers. Technical details and PoC are widely circulat

On Oct 21, 2026, China’s National Information Security Vulnerability Sharing Platform (CNVD) recorded two PHP remote code execution vulnerabilities (CNVD-2026-41674, CNVD-2026-41675; corresponding to CVE-2026-109618, CVE-2026-109619). Unauthenticated remote attackers can craft malicious HTTP requests that trigger memory errors and, under certain conditions, achieve denial of service, sensitive data theft, or remote code execution on affected servers. Technical details and PoC are widely circulated; CNVD urges affected users to upgrade to the latest versions immediately and assigns an overall rating of high risk.