---
title: "PHP2Shell vulnerabilities CVE-2026-109618, CVE-2026-109619"
slug: "php2shell-vulnerabilities-cve-2026-109618-cve-2026-109619"
updated: 2026-10-22T20:03:40Z
published: 2026-10-22T20:03:40Z
canonical: "docs.telosalliance.com/php2shell-vulnerabilities-cve-2026-109618-cve-2026-109619"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.telosalliance.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PHP2Shell vulnerabilities CVE-2026-109618, CVE-2026-109619

# Vulnerability Disclosure

## PHP2Shell

---

## Summary

The PHP2Shell vulnerabilities [[CVE-2026-109618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109618), [CVE-2026-109619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109619)] have been identified in some Telos Alliance products, and the investigation is ongoing. These vulnerabilities could be exploited to execute remote code on affected systems (RCE). We are disclosing this issue to our clients to ensure transparency and to encourage users to take necessary actions.

## Known Affected Products/Versions

- Zephyr Connect SE - Version 1.1.11 and earlier
- Altus SE - Version 2.2.3 and earlier
- Pathfinder Core Pro - Version 1.10.13 and earlier

> [!WARNING]
> WARNING: This list may change over time. The list was last updated on Thursday October 22nd at 12:45 ET. **Please follow this document to stay informed if additional products are listed.**

## Vulnerability Details

- **CVE ID:** [CVE-2026-109618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109618)
- **Severity Level:** Critical
- **Impact:** Remote Code Execution (RCE) - Allows an unauthenticated remote attacker to execute arbitrary code on the underlying server operating system with the privileges of the web server service account.
- **Technical Description:**
  - A critical remote code execution (RCE) vulnerability (CVSS 9.2) in PHP caused by out-of-memory (OOM) error handling where uninitialized request memory can be read or branched upon during cleanup.
- **CVE ID:** [CVE-2026-109619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109619)
- **Severity Level:** Critical
- **Impact:** Remote Code Execution (RCE) - Allows an unauthenticated remote attacker to execute arbitrary code on the underlying server operating system with the privileges of the web server service account.
- **Technical Description:**
  - A critical remote code execution (RCE) vulnerability (CVSS 9.2) in PHP caused by stale global state incorrectly resetting or repopulating, allowing subsequent requests to access freed memory.

## Mitigation & Fixes

Telos Alliance is working to provide software updates for currently shipping affected products. The lists below give the current status and links to software updates if available.

> [!WARNING]
> WARNING: This list may change over time. The list was last updated on Thursday October 22nd at 12:45 ET. **Please follow this document to stay informed if additional products are listed.**

- Pathfinder Core Pro - Release Candidate 1.10.14 patches the vulnerabilities [(Click here for the release notes doc which includes the download link)](https://docs.telosalliance.com/docs/110x#version-11014-10222026)
- Zephyr Connect SE - patch in progress
- Altus SE - patch in progress

For unpatched products, ensure proper network security is in place to limit the attack plane.

## Contact Information

For any questions or concerns regarding this disclosure, please contact Telos Alliance Customer Success Team at [https://www.telosalliance.com/support-request](https://www.telosalliance.com/support-request).