On October 21, 2026, the PHP project disclosed two critical vulnerabilities in the PHP language runtime, known together as PHP2Shell. Zixi products are not affected.
- Unauthenticated remote code execution [CVE-2026-109618]
- Unauthenticated remote code execution [CVE-2026-109619]
Both affect PHP from version 5.4 through 8.5. The PHP project has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Are Zixi products affected?
No. PHP is not used in, shipped with, or required by any Zixi product, so no Zixi software update is needed for PHP2Shell. This covers:
- Zixi Broadcaster, including its web interface and API
- ZEN Master
- Zixi Edge Compute (ZEC)
- Zixi Feeder, Receiver and the Zixi SDK
- ZaaS (Zixi as a Service) nodes managed by Zixi
The Zixi protocol, SRT, RIST, RTMP and every other protocol Zixi supports are also unaffected.
The zixi.com website
The zixi.com marketing website runs on WordPress, which uses PHP. It is a separate system from Zixi products and services and holds no customer streams, configuration or licence data. On October 21 we moved zixi.com behind our hosting provider’s protected network, which blocks PHP2Shell exploit attempts while the provider applies the PHP fix to its servers.
Do I need to do anything?
Not for your Zixi products. If you run PHP on your own servers, including any server that also runs Zixi software, update PHP to a fixed version or apply your operating system vendor’s patched packages. AlmaLinux, Red Hat, Ubuntu and Debian have published them.
If you have questions, please contact Zixi Support at support@zixi.com.
