Broadcast technology supplier Telos Alliance has identified two critical PHP vulnerabilities in some of its products and is investigating whether additional products are affected. The flaws, CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated remote attacker to execute code on an affected system with the privileges of its web server service account. Telos rated both vulnerabilities critical, with a CVSS score of 9.2.
The products and versions listed as affected in the company’s Oct. 22 advisory are Zephyr Connect SE 1.1.11 and earlier, Altus SE 2.2.3 and earlier, and Pathfinder Core Pro 1.10.13 and earlier. Telos said release candidate 1.10.14 patches the flaws in Pathfinder Core Pro; patches for Zephyr Connect SE and Altus SE were in progress. The company warned that its list could change as its investigation continues.
For products without a patch, Telos advises customers to use appropriate network security to limit exposure. The company will update its advisory with changes and directs customers with questions to its support team.
You can find more details in the advisory here.
These stories might interest you
Tech Focus: Telos pitches Z/IPStream for streaming