Vulnerability Disclosure

PHP2Shell

Summary

The PHP2Shell vulnerabilities [CVE-2026-109618, CVE-2026-109619] have been identified in some Telos Alliance products, and the investigation is ongoing. These vulnerabilities could be exploited to execute remote code on affected systems (RCE). We are disclosing this issue to our clients to ensure transparency and to encourage users to take necessary actions.

Known Affected Products/Versions

Zephyr Connect SE - Version 1.1.11 and earlier
Altus SE - Version 2.2.3 and earlier
Pathfinder Core Pro - Version 1.10.13 and earlier

WARNING: This list may change over time. The list was last updated on Thursday October 22nd at 12:45 ET. Please follow this document to stay informed if additional products are listed.

Vulnerability Details

CVE ID: CVE-2026-109618
Severity Level: Critical
Impact: Remote Code Execution (RCE) - Allows an unauthenticated remote attacker to execute arbitrary code on the underlying server operating system with the privileges of the web server service account.
Technical Description:
- A critical remote code execution (RCE) vulnerability (CVSS 9.2) in PHP caused by out-of-memory (OOM) error handling where uninitialized request memory can be read or branched upon during cleanup.
CVE ID: CVE-2026-109619
Severity Level: Critical
Impact: Remote Code Execution (RCE) - Allows an unauthenticated remote attacker to execute arbitrary code on the underlying server operating system with the privileges of the web server service account.
Technical Description:
- A critical remote code execution (RCE) vulnerability (CVSS 9.2) in PHP caused by stale global state incorrectly resetting or repopulating, allowing subsequent requests to access freed memory.

Mitigation & Fixes

Telos Alliance is working to provide software updates for currently shipping affected products. The lists below give the current status and links to software updates if available.

WARNING: This list may change over time. The list was last updated on Thursday October 22nd at 12:45 ET. Please follow this document to stay informed if additional products are listed.

Pathfinder Core Pro - Release Candidate 1.10.14 patches the vulnerabilities (Click here for the release notes doc which includes the download link)
Zephyr Connect SE - patch in progress
Altus SE - patch in progress

For unpatched products, ensure proper network security is in place to limit the attack plane.

Contact Information

For any questions or concerns regarding this disclosure, please contact Telos Alliance Customer Success Team at https://www.telosalliance.com/support-request.