We are seeing ongoing attacks on KVS sites to trigger Ghostscript CVE-2026-101258, FFmpeg MagicYUV CVE-2026-8461 and FFmpeg CVE-2026-65703 vulnerabilities. If these vulnerabilities are not fixed in your ffmpeg / ghostscript versions, your site may be attacked. All CVEs are already fixed, but your systems may be still vulnerable if not updated.
We have prepared a patch that will not allow exploiting these CVEs by restricting the subset of formats that are allowed to be passed to ffmpeg / imagemagick.
The patch supports PHP 7 - PHP 8 and KVS versions 6.3.0+. Unpack on top of your site to replace several files. Unfortunately no patch from our side for earlier version than 6.3.0. Please apply ASAP. The attacks are already running.
https://kernel-scripts.com/updates/media-security-6.3.0-7.0.3_patch.zip
KVS basic versions likely not affected, since no way to upload images or videos from public area. If you are running remote conversion servers, they may be infected if already exploited.