Security Advisory: Critical PHP vulnerabilities (PHP2Shell) and Encoded Media servers

22nd October 2026 1:39 AM
- Information
- Server Hardware

Overview

Two critical vulnerabilities in PHP, known as PHP2Shell and disclosed on 21 October 2026, affect TV Server and HD Encoder products.

Affected products

The Encoded Media products affected by the above vulnerabilities are:

TV Server platform 4.x, 5.x

HD Encoder platform 4.x, 5.x

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are rated Critical (9.2 out of 10). TV Server platform 3.x and earlier is unaffected.

Risk level

Encoded Media products hold no customer data and the risk is what an attacker could do from a compromised system:

Degrade the function of your product by stopping or interrupting TV playback
Use it for malicious activity such as sending unwanted traffic to other sites

A successful attacker will have been able to reach your server over the network. A server that is on a separate, protected segment, one that cannot be reached from outside, is at significantly lower risk.

Mitigation

Code provided here is for IT administrators only. Please email support@encodedmedia.com for advice.

TV Server platform 5.x

Run the following at a shell prompt on the server:

sudo bash <<'EOF'
s=/etc/nginx/sites-available/tvserver;d(){ echo "[php2shell] ERROR: $*";exit 1;}
printf '%s\n' '; Controlled by etvd.' '' '; Nothing here uses upload progress, and it hands an attacker a session write' '; before any of our code runs - the delivery path for PHP2Shell' '; (CVE-2026-109618/109619). Keep it off even on a patched PHP.' 'session.upload_progress.enabled = Off' >/etc/php/8.3/fpm/conf.d/99-etvd.ini
systemctl reload php8.3-fpm||d "php-fpm did not reload"
if ! grep -q multipart/form-data $s;then o=$(nginx -t 2>&1)||d "nginx config already broken, nothing changed: $o"
cp -p $s $s.pre-php2shell;awk '{print}!x&&/^[ \t]*server_name[ \t]/{print "    if ($content_type ~* \"multipart/form-data\") {\n        return 415;\n    }";x=1}' $s.pre-php2shell >$s
o="no server_name line";grep -q multipart/form-data $s&&o=$(nginx -t 2>&1)||{ cp -p $s.pre-php2shell $s;d "could not add the rule, $s restored, nginx not reloaded: $o";}
systemctl reload nginx||d "nginx did not reload";sleep 1;fi
u=$(curl -so/dev/null -m10 -w%{http_code} -Fx=1 http://127.0.0.1/login.php);p=$(curl -so/dev/null -m10 -w%{http_code} http://127.0.0.1/login.php)
[ $u = 415 ]&&[ $p != 415 ]&&[ $p != 000 ]||d "upload got HTTP $u (want 415), plain request got HTTP $p"
echo "[php2shell] done: uploads refused"
EOF

The output from this should be:

[php2shell] done: uploads refused

TV Server platform 4.x

Run the following at a shell prompt on the server:

echo 'session.upload_progress.enabled = 0' > /etc/php5/apache2/conf.d/99-tvs-mitigation.ini && apache2ctl restart && PHP_INI_SCAN_DIR=/etc/php5/apache2/conf.d php -c /etc/php5/apache2/php.ini -i | grep session.upload_progress.enabled

The output of this should be: session.upload_progress.enabled => Off => Off

Further information

Encoded Media products covered by an active support plan will receive a full software update that addresses these vulnerabilities in due course.

We are not able to provide software updates for older products outside their maintenance period. For these, the mitigations outlined above are the recommended protection. If you'd like to talk about support plan options, or replacing older units, your Encoded Media reseller will be pleased to help you.

Share via