Under Siege: Active Exploitation of Critical Video Platform Vulnerabilities

On April 21, 2026, Mjolnir Security's MIMIR predictive intelligence platform issued an 85% confidence prediction that critical vulnerabilities in WWBN AVideo and Oxia-DB would be actively exploited against technology, software development, and critical infrastructure targets. Within hours, a proactive threat hunt by our intelligence team confirmed the prediction: an active exploitation campaign was already in progress, targeting government agencies, public transit systems, media organizations, and NGOs across multiple continents. This report documents the campaign, the vulnerabilities under attack, and the intelligence cycle that detected it before traditional alerting channels.

MIMIR Called It First

On April 21, 2026, Mjolnir Security's MIMIR predictive intelligence platform — a machine-learning system that correlates vulnerability metadata, exploit publication timelines, threat actor activity patterns, and dark web chatter — issued a high-confidence prediction that critical vulnerabilities in WWBN AVideo (an open-source video streaming platform) and Oxia-DB would transition from theoretical risk to active exploitation.

The prediction carried an 85% confidence score, placing it in MIMIR's highest alert tier. The system identified the following risk factors:

• Predicted affected industries: Technology, Software Development, Critical Infrastructure
• Vulnerability characteristics: Unauthenticated remote code execution via OS command injection (CVE-2026-41064) and PHP-CGI argument injection (CVE-2024-4577)
• Exploit availability: Public proof-of-concept code circulating in offensive security channels
• Attack surface: Internet-facing installations deployed by government agencies, educational institutions, and media organizations worldwide

The MIMIR prediction triggered an immediate threat hunt by Mjolnir's intelligence team. Analysts pivoted from the predicted indicators to live telemetry sources, correlating known AVideo installation fingerprints with exploitation traffic patterns. Within hours, the team confirmed that active exploitation was not merely imminent — it was already underway.

Campaign Overview

The exploitation campaign targeting WWBN AVideo installations is both broad and sustained. Over the past 90 days, Mjolnir sensors have recorded 77 distinct exploitation events targeting internet-facing AVideo deployments. Over a one-year observation window, 687 network sessions associated with AVideo reconnaissance and exploitation activity have been cataloged.

The campaign targets a constellation of critical vulnerabilities in AVideo, chaining two distinct vulnerability classes for maximum impact. CVE-2026-41064 (CVSS 9.3) is an OS command injection in AVideo’s test.php where an incomplete patch left file_get_contents() and curl code paths unsanitized. The intercepted exploitation traffic, however, weaponizes the AVideo endpoint using CVE-2024-4577 — a PHP-CGI argument injection vulnerability — targeting test.php specifically because it is an unauthenticated PHP file exposed on production servers. Together with more than 10 critical CVEs disclosed against AVideo in 2026 alone, the pattern suggests deep, systemic security debt in the platform’s codebase.

Victims span multiple sectors and geographies:

• Government: City of Madrid and its digital platform estate
• Transportation: EMT Madrid (Empresa Municipal de Transportes de Madrid) — 440M+ annual passenger trips
• Media: ARD German public broadcaster (www.beyond-news.ard.de)
• Financial Technology: Clover POS platform (la.clover.com) and ilendx.tech financial lending platform
• Non-Governmental Organizations: Altervida, a Paraguayan environmental NGO (altervida.org.py)
• Web Services: Hosting providers and SaaS platforms across multiple continents

Two Vulnerability Classes, One Exploit Chain

The exploitation campaign chains two distinct vulnerability classes against AVideo’s test.php endpoint. Understanding the distinction is critical for effective remediation.

CVE-2026-41064 (CVSS 9.3) — OS Command Injection in test.php

The NVD record for CVE-2026-41064 describes an OS command injection vulnerability in AVideo’s test.php file. An earlier vulnerability (CVE-2026-33502, CVSS 9.0) documented unauthenticated SSRF and command injection through test.php’s handling of URLs passed to wget, file_get_contents(), and curl. The patch for CVE-2026-33502 added escapeshellarg() to the wget code path — but left file_get_contents() and curl unsanitised, and the URL validation regex (/^http/) accepts any string starting with “http”, including httpevil[.]com. CVE-2026-41064 is the result of that incomplete fix.

CVE-2024-4577 — PHP-CGI Argument Injection (The Intercepted Payload)

The exploit payload actually intercepted by our sensors uses a different vulnerability class entirely. The three-stage chain below is CVE-2024-4577 — a PHP-CGI argument injection vulnerability that allows attackers to override PHP runtime configuration directives via crafted query parameters. The attackers target AVideo’s test.php specifically because it is an unauthenticated PHP endpoint exposed on production servers — making it an ideal entry point for PHP-CGI exploitation.

// Variant A: -d flag syntax (standard form)
GET /AVideo/test.php
    ?-d+cgi.force_redirect=0       // Stage 1: Disable CGI redirect protection
    +-d+allow_url_include=1        // Stage 2: Enable remote file inclusion
    +-d+auto_prepend_file=php://input  // Stage 3: Execute POST body as PHP before script

// Variant B: %add encoding (WAF-evasion form, observed in campaign traffic)
GET /test.php
    ?%add+cgi.force_redirect=0
    +%add+allow_url_include=1
    +%add+auto_prepend_file=php://input

POST body: <?php echo md5("CVE-2024-4577"); ?>
// Verification payload — confirms RCE by returning a predictable MD5 hash
// If the hash appears in the response, the server will execute arbitrary code

Each stage serves a specific purpose:

• Stage 1 — cgi.force_redirect=0: Disables PHP’s CGI redirect security check, allowing direct access to the PHP-CGI binary.
• Stage 2 — allow_url_include=1: Enables PHP’s remote file inclusion capability, unlocking PHP stream wrappers.
• Stage 3 — auto_prepend_file=php://input: Instructs PHP to execute the raw POST body as code before the requested script runs.

The Incomplete Patch Chain

The relationship between these vulnerabilities illustrates a compounding failure. CVE-2026-33502 was partially patched — creating CVE-2026-41064. Meanwhile, the existence of test.php as an unauthenticated endpoint also exposes servers to CVE-2024-4577 if PHP runs in CGI/FastCGI mode. Patching one CVE does not address the other. The only comprehensive remediation is to remove test.php entirely from production deployments.

The Exploitation Campaign

The exploitation campaign is characterized by rapid, automated scanning followed by targeted exploitation against high-value installations. The most striking cluster of activity targeted infrastructure belonging to the City of Madrid and its municipal transit authority, EMT Madrid (Empresa Municipal de Transportes de Madrid) — which serves over 440 million passenger trips annually and operates in a metropolitan area of 3.3 million residents.

EMT Madrid and City of Madrid Infrastructure Targeting

In the most intensive burst observed, attackers launched 16 exploitation attempts in 8.5 seconds (1.9 attacks/second) targeting 15 distinct hostnames belonging to the City of Madrid and EMT Madrid during an attack window from 2026-04-12 19:45:48 to 2026-04-12 19:45:56. The full set of targeted hostnames is documented below:

The speed and precision of this burst — 16 requests across 15 unique hostnames in 8.5 seconds — indicates automated tooling operating from a pre-compiled target list. The attacker had already enumerated EMT Madrid and City of Madrid AVideo installations before launching the exploitation phase. Most alarming is the targeting of gitlab.emtmadrid.es:8080 — a GitLab instance that could expose source code repositories, CI/CD pipeline secrets, and hardcoded credentials.

Global Target Distribution

Beyond the concentrated Madrid targeting, the campaign has struck a diverse set of named victims across multiple continents:

The breadth of targeting — spanning government, transportation, media, financial technology, and NGO sectors across at least three continents — is consistent with opportunistic mass exploitation rather than a narrowly-targeted espionage campaign. The attackers appear to be exploiting every reachable AVideo installation regardless of the victim's sector or geography.

A North American Installation Under Surveillance

Deep analysis of a single North American AVideo installation — hosted at 74.111.27.184 (Verizon Business, ASN 701, Canada) — provides a window into the sustained nature of this campaign. Over a one-year observation period, this installation recorded 687 network sessions exhibiting reconnaissance and exploitation behavior.

Installation Discovery Probes

A significant portion of observed traffic targeted the /AVideo/install/index.php endpoint — the platform's installation wizard. The presence of this endpoint on a production system is itself a critical misconfiguration: it indicates that the installation process was never finalized or that the installer was not removed after deployment. Attackers probe this endpoint to determine whether a target can be trivially re-configured or backdoored. Notably, the installation wizard's error-handling is vulnerable to reflected XSS via the db_error parameter at the database_config step.

Traffic Analysis

Port-level traffic analysis revealed a distinctive pattern:

The near-equal split between standard HTTP exploitation traffic and high-port ephemeral connections is significant. The ephemeral port traffic (concentrated in the 41xxx range) is consistent with reverse shell callbacks — a pattern where the compromised server initiates an outbound connection to attacker-controlled infrastructure on a non-standard port to establish an interactive command shell.

User-Agent Anomaly

A substantial volume of sessions presented a Chrome 109 user-agent string. Chrome 109 was released in January 2023 and has been superseded by dozens of subsequent versions. The use of this outdated user-agent is a strong indicator of automated scanning tooling rather than legitimate browser traffic. Offensive security tools and exploit frameworks frequently hard-code user-agent strings from the era in which they were developed, creating a detectable fingerprint.

The Platform's Vulnerability Crisis

CVE-2026-41064 is not an isolated vulnerability. It is the most severe manifestation of a systemic security crisis in the WWBN AVideo platform. In 2026 alone, more than 10 critical CVEs have been disclosed — all enabling unauthenticated remote access, and many sharing common root causes.

CVE-2026-40946 — Oxia-DB JWT Authentication Bypass

The MIMIR prediction also flagged CVE-2026-40946, a critical authentication bypass in Oxia-DB, the distributed coordination database used in cloud-native architectures for distributed locking, leader election, and configuration management. This vulnerability has a distinct and alarming technical profile.

The root cause is a complete failure to validate the aud (audience) claim during JWT verification. When Oxia-DB verifies JWTs issued by an OIDC identity provider, it validates the token signature and expiry but entirely skips the audience claim check. The consequence is severe: any valid JWT issued by the same identity provider — regardless of the intended audience — will successfully authenticate to Oxia-DB. An attacker who can obtain a JWT for any service in the same IdP realm gains full read/write access to Oxia-DB's coordination state.

The Pattern of Incomplete Fixes

A recurring pattern across AVideo's vulnerability disclosures is incomplete remediation. Patches address specific attack vectors while leaving the underlying vulnerability class intact. CVE-2026-41064 is a direct bypass of the CVE-2026-33502 fix. This pattern suggests that the development team is treating symptoms rather than root causes.

The eval() Anti-Pattern

Multiple AVideo CVEs trace back to the use of PHP's eval() function and related dynamic code execution constructs on user-controlled input. This is a well-documented anti-pattern that has been considered a critical security risk for over a decade. The persistence of eval()-based code paths in a platform deployed by government and educational institutions indicates a fundamental gap in secure development practices.

Why AVideo Is Attractive to Attackers

AVideo (formerly YouPHPTube) is deployed by organizations that need a self-hosted, open-source alternative to commercial video platforms. Its adoption footprint includes:

• Government agencies that require data sovereignty and cannot use commercial cloud video services
• Educational institutions that need FERPA/GDPR-compliant video hosting
• Media organizations that operate their own streaming infrastructure
• Non-profits and NGOs that lack budget for enterprise video platforms

This deployment profile means that AVideo vulnerabilities disproportionately affect organizations with high-value data and limited security resources — an ideal target profile for both opportunistic and targeted threat actors.

Threat Actor Assessment

Attribution for this campaign remains under investigation. The exploitation pattern — broad targeting, automated tooling, and opportunistic victim selection — is consistent with multiple threat actor profiles. Mjolnir assesses three primary scenarios at moderate confidence:

MITRE ATT&CK Mapping

Indicators of Compromise

The following indicators are derived from exploit payloads and scanning patterns. Victim-specific hostnames and IP addresses have been withheld pending responsible disclosure.

Recommendations

Immediate Actions (Critical)

• Remove test.php: Delete the test.php file from all AVideo installations immediately. This file serves no production purpose and is the primary exploit entry point.
• Block install/ directory: Configure web server access controls to deny all requests to /install/ and /AVideo/install/ paths. Remove the installer if present.
• Update to latest version: Apply all available AVideo security patches. Note that patching alone may be insufficient due to the pattern of incomplete fixes.
• Audit for prior compromise: Review web server access logs for requests matching the exploit patterns documented above. Check for unauthorized files, modified configurations, and unexpected cron jobs or scheduled tasks.
• Review outbound connections: Examine network flow data for outbound connections from AVideo servers to unusual high-port destinations (particularly in the 41xxx range), which may indicate active reverse shell sessions.

WAF / IDS Rules

# Block CVE-2026-41064 exploit payloads
SecRule REQUEST_URI "test\.php.*cgi\.force_redirect" "id:100001,deny,status:403,msg:'CVE-2026-41064 exploit attempt'"
SecRule REQUEST_URI "test\.php.*auto_prepend_file" "id:100002,deny,status:403,msg:'PHP CGI prepend injection'"
SecRule REQUEST_URI "test\.php.*allow_url_include" "id:100003,deny,status:403,msg:'PHP CGI include injection'"

# Block installation endpoint access
SecRule REQUEST_URI "/(AVideo/)?install/" "id:100004,deny,status:403,msg:'AVideo installer access blocked'"

# Block %add-encoded PHP-CGI injection variant
SecRule REQUEST_URI "test\.php.*%add.*php:/input" "id:100006,deny,status:403,msg:'CVE-2024-4577 %add encoded variant'"
SecRule REQUEST_URI "test\.php" chain
SecRule REQUEST_BODY "@contains <?php" "id:100007,deny,status:403,msg:'PHP code in POST body to test.php'"

# Flag outdated Chrome user-agent on AVideo paths
SecRule REQUEST_HEADERS:User-Agent "Chrome/109" chain
SecRule REQUEST_URI "/AVideo/" "id:100008,log,msg:'Suspected AVideo scanning tool'"

Strategic Recommendations

• Evaluate alternatives: Given the volume and severity of AVideo vulnerabilities in 2026, organizations should evaluate whether continued use of the platform is defensible. Consider migration to actively-maintained alternatives with established security programs, such as Panopto, Kaltura, or Vimeo OTT — all of which offer enterprise video capabilities with dedicated security and compliance programs.
• File integrity monitoring: Deploy file integrity monitoring (FIM) on all AVideo installation directories. Any modification to PHP files, configuration files, or the creation of new files outside of authorized update processes should trigger an immediate alert.
• Network segmentation: AVideo servers should be isolated in a dedicated network segment with strict egress filtering. Deny all outbound connections except those required for legitimate operation (e.g., DNS, NTP, CDN endpoints).
• PHP hardening: Disable PHP CGI mode entirely if not required. Set allow_url_include=Off and allow_url_fopen=Off in php.ini. Restrict disable_functions to block eval, exec, system, passthru, shell_exec, popen, proc_open.

How Mjolnir Security Can Help