PlayBox Technology Confirms Its Products Are Not Affected by Recently Disclosed PHP Vulnerabilities
Security clarification confirms that PlayBox Technology broadcast products do not use the PHP components associated with CVE-2026-109618 and CVE-2026-109619
PlayBox Technology today confirmed that its broadcast software products do not use PHP components associated with the recently disclosed vulnerabilities CVE-2026-109618 and CVE-2026-109619.
The clarification follows a security advisory from Wibu-Systems concerning potential vulnerabilities affecting CodeMeter License Central and associated extensions, including WebDepot, gateways, customer licensing portals and connectors.
According to the advisory, the vulnerabilities concern PHP components used by the affected web applications. CodeMeter Runtime and WibuKey, installed locally on end-user machines, are not affected by these specific vulnerabilities.
PlayBox Technology confirms that its products do not incorporate the affected PHP components and are therefore not affected by these vulnerabilities.
Understanding the architectural distinction
The disclosure highlights an important distinction within broadcast technology: the security profile of a broadcast solution depends not only on its core playout and media processing functions, but also on the implementation of associated web interfaces, licensing services and management infrastructure.
Where PHP-based web applications or licensing gateways are deployed, their exposure depends on the components used, their versions, the deployment architecture and the security updates available. Such components should be assessed independently of the underlying broadcast playout environment.
PlayBox Technology’s clarification relates specifically to the two vulnerabilities identified in the Wibu-Systems advisory. It is not a general claim that any software architecture or licensing mechanism is immune to security vulnerabilities.
Commitment to customer confidence
PlayBox Technology continues to focus on the reliability, continuity and security of professional broadcast operations. The company encourages customers to follow relevant vendor security advisories and apply appropriate updates to any third-party systems within their own environments.
Customers using PlayBox Technology products do not need to take specific remediation action in relation to CVE-2026-109618 and CVE-2026-109619 on account of those products.
