PHP Security

[Chillout 142]

PHP Security Warning -  Does this affect Emby?  It passes the checker at a high level...

 

[remid12 7]

I just also see the new, most of french governement web site was passed in maintenance mode as 2 critical security issue was found on PHP.
I would be interested to know if emby use php and if it's better to turn off any external access temporary.
Thanks a lot.

Edit : I checked the server processes for PHP-related components (PHP, Apache, Nginx and IIS), and nothing was detected. Based on this initial check, it appears that Emby is not using PHP on this server, so the recently disclosed PHP vulnerabilities should not directly affect this installation.
Anyway, better to look for confirmation from the Emby team in case any embedded component is involved.

Edited October 21 by remid12

[remid12 7]

@LukeCan you please have a look on this topic, which could be maybe very critical ? Thanks a lot.

[Luke 43549]

Emby Server does not use PHP.

[remid12 7]

Nice, Thanks a lot for your answer

[katbyte 52]

@Luke 

There was however an OOB .NET update 2 days ago (https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates/) for the HTTP2Shell Brotli RCE (CVE-2026-111497). I landed here checking whether anyone had mentioned it yet, since it’s loosely related to the same current CVE wave PHP was in.

I don’t think it’s a serious concern for Emby. The inbound RCE needs request decompression enabled, and Emby doesn’t appear to decompress Brotli request bodies. A Brotli-encoded POST gets parsed as raw bytes and fails:

 

2026-10-27 16:54:56.068 Error UserService-0HNPK12POULI2:00000002: Error processing request
        System.Runtime.Serialization.SerializationException: System.Runtime.Serialization.SerializationException: Type definitions should start with a '{', expecting serialized type 'AuthenticateUserByName', got string starting with: �{"Username":"nobody-test","Pw":"wrong"}

It may still be possible via outbound requests, if HttpClient has automatic decompression enabled with DecompressionMethods.Brotli or All. In that case metadata providers, M3U/XMLTV URLs and so on could in theory deliver a payload, especially from less reputable sources. I didn’t test that, since i have not configured emby to use anything I’d worry about.

That said, do y’all have any plans to bump .NET to 8.0.33 soonish? It would clear most of the other .NET runtime CVE noise (that do not apply) scanners are now flagging on the image.  

[Cat091 2]

People on reddit are saying theres an rce exploit on emby, I doubt its true but @Luke can you check? 

[katbyte 52]

1 hour ago, Cat091 said:

People on reddit are saying theres an rce exploit on emby, I doubt its true but @Luke can you check? 

could you share the links/threads where people are saying that? i can't find anything with a quick google and i'm not aware of any (thou there was plex2shell last week)

Edited October 28 by katbyte

[Cat091 2]

10 minutes ago, katbyte said:

could you share the links/threads where people are saying that? i can't find anything with a quick google and i'm not aware of any (thou there was plex2shell last week)

  

 

[katbyte 52]

hmm, well my first guess would be they are making it up/thinking of the 2025 incident (https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84) - folks in the thread seem skeptical, however that also seems to be the actual dev of Plezy making it quite the claim to make without it being true.. 

And if it is true i would really hope they have already reached out to the emby devs to let them know otherwise that is a bad look. And if they have reached out already and its not been patched.. well thats still a bad look lol - well depending on the type of RCE, and they are claiming unauthenticated RCE. I would keep in mind an RCE could be anything from getting shell at the login screen while unauthenticated (really bad) or require a logged in user (bad but less so) and/or a specific uncommon setup (probably not that bad). so i would wait for luke to weight in.

direct link to the actual comment for you luke/anyone else 

Edited October 28 by katbyte

[Luke 43549]

23 minutes ago, katbyte said:

(https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84) 

this one is old and an update already went out for it.

[katbyte 52]

12 minutes ago, Luke said:

this one is old and an update already went out for it.

very good to know! thank you for quick reply here

[Joniyo 0]

On 27/10/2026 at 19:44, Luke said:

this one is old and an update already went out for it.

do you mean (https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84) from last year or the one plezy dev edde746 claimed was unpatched as of yesterday is fixed, or both? @Luke

Edited October 29 by Joniyo

[Luke 43549]

33 minutes ago, Joniyo said:

do you mean (https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84) from last year or the one plezy dev edde746 claimed was unpatched as of yesterday is fixed, or both? @Luke

That one indicates the patched versions that you need to update to in order to get the fix. Which at this point you probably already have because they were new versions a year ago.

[Joniyo 0]

9 hours ago, Luke said:

That one indicates the patched versions that you need to update to in order to get the fix. Which at this point you probably already have because they were new versions a year ago.

Yes I understand that regarding the link to GitHub it was patched long ago, but I a would like to know about the Reddit thread/link from the last couple days where tht plezy dev is claiming there is a current unpatched unauthenticated RCE right now? if there is or it’s just talk the one @Cat091was concerned about @Luke

[Luke 43549]

42 minutes ago, Joniyo said:

Yes I understand that regarding the link to GitHub it was patched long ago, but I a would like to know about the Reddit thread/link from the last couple days where tht plezy dev is claiming there is a current unpatched unauthenticated RCE right now? if there is or it’s just talk the one @Cat091was concerned about @Luke

I don’t see any specifics.

[Joniyo 0]

No the plezy dev did not share any details just made this claim with zero evidence and it sounds like if true they have not informed you

Edited October 30 by Joniyo

[Joniyo 0]

@Lukecan we assume it’s not true and that developer is wrong and there is no current unpatched rce?

[Luke 43549]

31 minutes ago, Joniyo said:

@Lukecan we assume it’s not true and that developer is wrong and there is no current unpatched rce?

Hi, the best thing to do is subscribe to this repository:

https://github.com/EmbySupport/Emby.Security

And then you will learn about anything like that the moment it becomes known.