Telos Alliance has disclosed two critical PHP vulnerabilities in specified versions of three broadcast audio and control products. Its advisory lists Zephyr Connect SE 1.1.11 and earlier, Altus SE 2.2.3 and earlier, and Pathfinder Core Pro 1.10.13 and earlier as known affected releases. Telos assigns both CVE-2026-109618 and CVE-2026-109619 a CVSS score of 9.2 and says an unauthenticated remote attacker could execute code with the privileges of the web-server service account.
The vendor describes CVE-2026-109618 as an out-of-memory error-handling flaw in PHP in which uninitialised request memory can be read or used during cleanup. CVE-2026-109619 involves stale global state being reset or repopulated incorrectly, potentially allowing a later request to access freed memory. Telos calls the pair PHP2Shell and says its investigation is continuing, so the affected-product list may change.
The mitigation status is uneven. Telos says Pathfinder Core Pro release candidate 1.10.14 patches the flaws. Patches for Zephyr Connect SE and Altus SE were still in progress when the advisory was updated on 22 October. For products without a patch, the company recommends network controls that reduce the exposed attack surface. Broadcast operators should therefore inventory the exact product and software version before treating a newer unrelated release number as proof of protection.
Several operational facts remain unresolved in the public notice. Telos has not documented observed exploitation, a proof of concept, the precise network service or request path required, or a stable-release timetable for every affected product. The advisory also warns that its scope is provisional. Facilities using these systems should follow Telos' live document and test upgrades within their own maintenance and on-air continuity procedures rather than assuming the first published list is final.
