PHP vulnerabilities force Sonos to suspend NetEase Cloud Music, QQ Music, Kugou and Kuwo services in its official app in China
PHP recently disclosed two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which let unauthenticated attackers execute arbitrary code remotely; the PHP Foundation issued an emergency security update on October 21 (versions 8.5.12, 8.4.27, 8.3.36, 8.2.35). In response, Sonos China announced it is suspending NetEase Cloud Music, QQ Music, Kugou and Kuwo services inside its official app, with restoration expected within days; users' collections and playlists are unaffected. Given how widely PHP is used server-side, the blast radius of this flaw deserves attention.
SOURCES
- IT之家2026-10-23 05:42