Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Kaltura video management services
Incident: Disclosure of two critical unpatched vulnerabilities (CVE-2026-19913, CVE-2026-19912) in Kaltura’s mwEmbed library.
Impact: Remote attackers can read sensitive configuration files and execute arbitrary code on the server.
Attacker: Unidentified threat actors
Analysis: The vulnerabilities stem from unsafe deserialization in the mwEmbedLoader.php endpoint. Attackers can leverage the ServiceUrl parameter to read local server files or inject malicious serialized objects to achieve remote code execution. Because these flaws exist on both standalone installations and shared CDN infrastructure, the attack surface is exceptionally broad.
Recommendations: Restrict or disable external access to the mwEmbedLoader.php endpoint.; Implement a strict allow-list for the ServiceUrl parameter to permit only trusted API URLs.; Monitor server logs for unusual requests containing file paths or traversal sequences in the uiconf_id parameter.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source