Telos Alliance flags critical PHP flaws in three products

Telos Alliance has told customers that some of its broadcast products carry two critical PHP vulnerabilities, grouped under the name PHP2Shell. The company published its advisory on October 22 and says the investigation is still running.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and Telos rates both as critical with a CVSS score of 9.2. An unauthenticated remote attacker could use either one to execute arbitrary code on the underlying server operating system, with the privileges of the web server service account.

What goes wrong in PHP

CVE-2026-109618 comes from out-of-memory error handling. During cleanup, uninitialized request memory can be read or branched upon.

CVE-2026-109619 is caused by stale global state that resets or repopulates incorrectly. Later requests can then reach memory that has already been freed.

Affected products and fixes

The advisory lists three products: Zephyr Connect SE version 1.1.11 and earlier, Altus SE version 2.2.3 and earlier, and Pathfinder Core Pro version 1.10.13 and earlier. Telos last updated that list on Thursday, October 22, at 12:45 ET and warns that more products may be added.

Pathfinder Core Pro already has a fix in release candidate 1.10.14, and the release notes carry the download link. Patches for Zephyr Connect SE and Altus SE are still in progress.

For any product that has no patch yet, Telos tells customers to make sure proper network security is in place to limit the attack plane. It says it is disclosing the issue to clients for transparency and so that they can act, and it directs questions to its Customer Success Team. The company will update the advisory as its investigation produces changes.

Source: Telos Alliance