Security Announcements Archives - MediaCP https://www.mediacp.net/category/security-announcements/ Media Control Panel Fri, 13 Feb 2026 03:25:53 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.7 https://www.mediacp.net/wp-content/uploads/2025/07/IconSquare-Transparent-150x150.png Security Announcements Archives - MediaCP https://www.mediacp.net/category/security-announcements/ 32 32 Security Advisory [All Versions] https://www.mediacp.net/news/2026-02-12-security-advisory-all-versions/ Thu, 12 Feb 2026 05:37:39 +0000 https://www.mediacp.net/?p=33395 Several critical XSS security issues have been identified that affects all versions of MediaCP Audio and Video Panel. The security vulnerabilities may allow an unauthorized attacker to gain admin access to the MediaCP software. We have published new minor updates to the LTS, Stable, and Latest release tiers and urge all customers to upgrade MediaCP […]

The post Security Advisory [All Versions] appeared first on MediaCP.

]]> Several critical XSS security issues have been identified that affects all versions of MediaCP Audio and Video Panel.

The security vulnerabilities may allow an unauthorized attacker to gain admin access to the MediaCP software.

We have published new minor updates to the LTS, Stable, and Latest release tiers and urge all customers to upgrade MediaCP immediately.

Severity: Critical
Versions Affected: <= 2.13.13, <= 2.14.8, <= 2.15.1
References: MCP-2970, MCP-2969

What should I do?

You should upgrade MediaCP immediately, as soon as possible.

If you are unable to upgrade due to an unsupported operating system we do have two hot-fixes available for 2.13.x and 2.14.x

2.13.x Hot-fix:

  1. Access your server over SSH as the root user
  2. Run the following to apply the hot-fix
bash <(curl -s https://mirror.mediacp.net/download/hotfix/MCP-2969-2970-2980-21314.txt?v1)

2.14.x Hot-fix:

  1. Access your server over SSH as the root user
  2. Run the following to apply the hot-fix
bash <(curl -s https://mirror.mediacp.net/download/hotfix/MCP-2969-2970-2980-2149.txt?v2)

Can the hot-fix be applied to earlier versions?

The hot-fixes are built specifically for the currently supported releases of 2.13, 2.14, and 2.15 and may not be compatible. We do not recommend applying the hot-fix to versions earlier than 2.13.

Release Notes:

The post Security Advisory [All Versions] appeared first on MediaCP.

]]> Wowza log4j2 security vulnerability https://www.mediacp.net/security-announcements/security-wowza-log4j2-security-vulnerability/ Thu, 16 Dec 2021 06:37:46 +0000 https://www.mediacp.net/?p=13493 Severity: CriticalVersions: Wowza Streaming Engine >= 4.8.8.01Exploit type: Apache Log4j2 security vulnerability (CVE-2021-44228 & CVE-2021-45046) A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). This vulnerability is actively being exploited and anyone using Log4j should update to version 2.15.0 as soon as […]

The post Wowza log4j2 security vulnerability appeared first on MediaCP.

]]> Severity: Critical
Versions: Wowza Streaming Engine >= 4.8.8.01
Exploit type: Apache Log4j2 security vulnerability (CVE-2021-44228 & CVE-2021-45046)

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). This vulnerability is actively being exploited and anyone using Log4j should update to version 2.15.0 as soon as possible.

Logging in Wowza Streaming Engine 4.8.8.01 and later uses a version of Apache Log4j2 with a security vulnerability (CVE-2021-44228) involving JNDI functionality that is not protected against attacker-controlled LDAP and other JNDI-related endpoints.

If you have Wowza Streaming Engine installed on your system, you should immediately apply the update patch. If you do not have Wowza Streaming Engine installed then no action is required.

Solution

You can manually apply the Wowza update to fix the Apache Log4j2 security vulnerability or run the following command to apply all steps automatically.

sh -c "$(curl -sSL https://mirror.mediacp.net/download/hotfix/WSE-log4j2-patch.txt)"

The post Wowza log4j2 security vulnerability appeared first on MediaCP.

]]> DST Root CA X3 Expiration and Let’s Encrypt (Sep 2021) https://www.mediacp.net/news/dst-root-ca-x3-expiration-and-lets-encrypt/ Mon, 04 Oct 2021 00:43:56 +0000 https://www.mediacp.net/?p=12473 As of September 30th, 2021, the DST Root CA X3 certificate that is used in the chain of trust for Let’s Encrypt expires causing clients that do not recognize ISRG Root X1 to fail security checks when accessing sites that use Let’s Encrypt for their SSL provider. The details about this issue can be found […]

The post DST Root CA X3 Expiration and Let’s Encrypt (Sep 2021) appeared first on MediaCP.

]]> As of September 30th, 2021, the DST Root CA X3 certificate that is used in the chain of trust for Let’s Encrypt expires causing clients that do not recognize ISRG Root X1 to fail security checks when accessing sites that use Let’s Encrypt for their SSL provider.

The details about this issue can be found in the following post made by Let’s Encrypt about this issue

The problem is not specific to the MediaCP software and affects many users using LetsEncrypt certificates. Many cPanel users are also experiencing the problem are also experiencing the problem.

Our technical team have done some further research and we’ve written this guide on how to solve the problem on any CentOS or Debian machine.

How to check if you are affected?

Checking for the issue is simple, run the following on your MediaCP system (replacing your-domain.com with your actual domain name). 

curl https://your-domain.com:2020 > /dev/null

If there is a problem then you will see the error “(60) SSL certificate problem: certificate has expired” but do not worry, your certificate is not necessarily expired and the solution is simple.

Workaround

CentOS 7+

For servers running CentOS 7 or higher, the issue has been solved in recent operating system updates. We recommend running the following on your system as root user.

yum clean all;
yum -y update;
yum -y install ca-certificates;
yum -y update ca-certificates;
update-ca-trust;

Debian Servers

For Debian servers, the problem can be solved simply by running the following on your system as root:

mv /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt.backup;
sudo update-ca-certificates;

The post DST Root CA X3 Expiration and Let’s Encrypt (Sep 2021) appeared first on MediaCP.

]]> CentOS 6 Discontinued https://www.mediacp.net/news/centos-6-discontinued/ Wed, 29 Apr 2020 05:10:40 +0000 https://www.mediacp.net/?p=7696 It has been decided that the MediaCP support for CentOS 6 will end on 10th May 2020. After this date it will not be possible to install or upgrade the MediaCP on CentOS 6. Attention Required If you are still using CentOS 6 currently then you should upgrade to CentOS 7 before this date. * […]

The post CentOS 6 Discontinued appeared first on MediaCP.

]]> It has been decided that the MediaCP support for CentOS 6 will end on 10th May 2020. After this date it will not be possible to install or upgrade the MediaCP on CentOS 6.

Attention Required

If you are still using CentOS 6 currently then you should upgrade to CentOS 7 before this date. * Note CentOS 8 is not currently supported.

Why will CentOS 6 no longer be supported?

CentOS 6 will officially reach end of life in November this year meaning security patches and bug fixes will no longer be provided by CentOS.

Our next version, MediaCP 2.9, will introduce support for Liquidsoap version 1.4 which is not compatible with CentOS 6. For this reason we have decided to remove CentOS 6 support at the same time as we launch MediaCP 2.9.

When will CentOS 8 be supported?

CentOS 8 will be supported on 11th May 2020.

The post CentOS 6 Discontinued appeared first on MediaCP.

]]>