On October 21, 2026, the PHP project released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Wowza reviewed its products and services the same day.
The products customers rely on to stream and deliver mission-critical video, including Wowza Streaming Engine and Wowza Streaming Engine Manager, do not use PHP and were not affected. A small number of auxiliary services, separate from these products, were updated to the fixed PHP release on October 21.
No action is required from customers.
Best regards,
Wowza Information Security