There are two CVE’s (CVE-2026-109618, CVE-2026-109619), both with a rating of 9.2 out of 10. They allow unauthenticated code execution.

From the phpfoundation website:

CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

These work for at least the 7 series, there were no more ads in the menu’s.

I can share the pihole domains I have for my samsung tv (although it’s no longer connected to the internet now)

• ocfconnect-shard-eu[0-9]{2}-euwest1.samsungiotcloud.com (regex deny)
• ads.samsungads.com (exact deny)
• samsungacr.com (exact deny)
• samsungotn.net (exact deny)
• log-config.samsungacr.com (exact deny)
• gpm.samsungqbe.com (exact deny)
• config.samsungads.com (exact deny)

It stopped any ads coming through and also prevent (some) data going back to them, mind you this also breaks installing new apps on the tv, so disable, install app from their store, enable again.

Hope this helps

we talking ps4 or ps5 controllers?