Critical security advisory: immediate action is required from every MediaCP administrator.
MediaCP has been made aware of the PHP2Shell vulnerability. This is a critical-risk issue affecting all MediaCP versions. There is no MediaCP patch available at this time.
Do not ignore this warning. Take the mitigation steps below now while we prepare a MediaCP update.
Immediate mitigation
To reduce exposure immediately, block public access to the MediaCP web-service ports:
- 80
- 443
- 2000
- 2020
Important: Blocking these ports will also block stream proxy access and video/HLS playback. Broadcasts themselves will otherwise remain active.
PHP security release
PHP.net has announced a critical security release for Wednesday, 21 October 2026 at 14:00 UTC. Once the patched PHP versions are available, administrators can deploy a custom PHP build using the instructions at Installing a custom PHP version. We are currently preparing and expanding this resource.
PHP.net may also publish temporary configuration-based mitigations. Please monitor php.net and MediaCP email announcements closely. If an interim PHP configuration change is provided, administrators should be ready to apply the required php.ini overrides while an official MediaCP patch is being prepared.
MediaCP update plan
MediaCP is targeting an update within six hours of the PHP release. When it is available, all administrators should run the MediaCP update utility as soon as possible.
The MediaCP update may initially be available only for supported, current PHP versions. We hope PHP fixes will be backported, but this cannot be guaranteed. If fixes are not backported to your PHP version, MediaCP LTS may not be patchable; in that case, all affected users should move to MediaCP Stable 2.15.x immediately.
What to do now
- Ensure you are running MediaCP Stable 2.15 or Latest 2.16 immediately.
- Block access to ports 80, 443, 2000 and 2020 where your operational requirements allow.
- Plan for the resulting interruption to stream proxy access and video/HLS playback.
- Monitor PHP.net and MediaCP announcements for the PHP release and interim mitigation guidance.
- Prepare to deploy the patched PHP version as soon as it is released.
- Run the MediaCP update utility immediately once the MediaCP update is announced.
We will publish further information as it becomes available.
