We have updated Telldus Live! following critical security vulnerabilities in PHP

On October 20, two serious security vulnerabilities in PHP became known. PHP is one of the most widely used programming languages for web services and powers parts of Telldus Live! and the Telldus API, among others.

What happened?

The vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell, have been given a severity rating of 9.2 out of 10. In the worst-case scenario, they could allow an attacker to run their own code on a web server without logging in. Information about the vulnerabilities leaked before the planned publication, and PHP released patched versions on October 21. Several security companies have since reported attempts to exploit the vulnerabilities.

What have we done?

We acted immediately and have upgraded PHP and addressed the security vulnerabilities. In a situation like this, time is of the essence, so we chose to shorten our usual testing to get the protection in place as quickly as possible.

What can you expect?

From today, Friday, October 23, and throughout the weekend, there may be bugs or disruptions in Telldus Live! and the Telldus API. This may manifest as slower response times, temporary login issues, or features not behaving as usual. We are closely monitoring the services and fixing errors as they arise.

Do you need to do anything?

No. But if you notice that something is not working as it should, we would appreciate it if you contact our support center. Current status is always available under Service Information.

We apologize for any inconvenience and thank you for your patience while we ensure that everything is working as it should.