China’s MIIT NVDB warns of two critical PHP remote code execution flaws

The significance here is less the flaw class than the source: a Chinese state cybersecurity platform issuing a formal risk warning signals the exposure is being treated as systemic, not routine. Because PHP underpins a vast share of web infrastructure, unauthenticated remote code execution in supported branches puts server operators and downstream users at risk well beyond any single vendor. The affected-version list is broad, and the older branches named suggest prolonged patching exposure. Whether operators move to patched releases quickly, and how widely exploit attempts surface, is the open question worth watching.