PHP CVE-2026-19912

Kaltura HTML5 Player contains a critical unauthenticated remote code execution vulnerability (CVSS 9.8) that allows attackers to execute code without valid credentials or special conditions. Organizations using Kaltura for video delivery risk compromise of their video infrastructure, customer data, and downstream systems. Although no public exploit identified at time of analysis, the high severity and apparent lack of vendor patches require immediate remediation and interim protective measures.

Within 24 hours, contact Kaltura support directly to confirm the availability of a security patch for your specific HTML5 Player version and request an expedited security bulletin. Within 7 days, apply any released patch to all Kaltura instances in production and testing environments; if no patch is available, implement the compensating controls below and document the business risk in your compliance and risk registers. Within 30 days, perform full regression testing of video playback and player functionality post-patch, update your vulnerability tracking system, and schedule a follow-up with Kaltura to confirm patch release timelines.

No vendor-released patch identified at time of analysis. Interim mitigations while awaiting patch: (1) Disable or restrict PHP unserialize() function via php.ini configuration for the webserver environment hosting Kaltura, (2) Implement strict input validation and whitelist-based filtering on all user-controllable parameters passed to the player, (3) Deploy Web Application Firewall (WAF) rules to detect and block serialized PHP object signatures in HTTP traffic, (4) Run Kaltura webserver process with minimal necessary file system permissions (restrict write access to specific cache directories only), (5) Isolate Kaltura infrastructure from other critical systems using network segmentation and firewall rules, (6) Enable and monitor webserver access logs and PHP error logs for suspicious unserialize() activity and unexpected cache-path modifications.