PHP2Shell (CVE-2026-109618/-109619): Travido software is not affected.
The Travido VideoHub and the traVES evidence software contain no PHP component – neither in the application nor in the update package. The critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”) therefore don’t affect Travido installations. Our customers don’t need to take any action.
What happened
On October 20, 2026, details of two critical vulnerabilities in the PHP programming language leaked ahead of coordinated disclosure. They let attackers run malicious code on web servers without logging in – effectively taking the server over. The PHP project rates both 9.2 out of 10 (CVSS v4.0) and released fixes on October 21, 2026. Older PHP versions will no longer receive a fix.
Our products at a glance
| Product | Status | Why |
|---|---|---|
| Travido VideoHub | not affected | built on Java; no PHP in the application or update package |
| traVES evidence software | not affected | native Windows application that runs without an internet connection |
| Website travido.gmbh | not affected | not built on PHP |
VideoHub 0.7.5 is available
Separately from PHP2Shell, version 0.7.5 of the VideoHub is available. It improves shutdown and restart behavior and installs updates only through the settings – with checksum verification. Installation takes a few minutes via SD card; videos, users and settings are preserved. We’ll send existing customers the package with installation instructions, or install it together with you.
Security is built into our architecture
Travido develops and builds in-vehicle video evidence systems for emergency vehicles in Braunschweig, Germany. Every recording is signed automatically inside the vehicle, following the recommendations of Germany’s Federal Office for Information Security (BSI TR-02102-1, RSA-3072 with SHA-256). Any independent party – court, expert witness, defense – can verify authenticity with standard tools. And with traVES, evidence review stays entirely inside your station, with no internet connection.
New: traVES, the evidence software that works offline →
Frequently asked questions
Is Travido affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)?
No. The Travido VideoHub is built on Java, and the traVES evidence software is a native Windows application. Neither contains a PHP component.
Do Travido customers need to do anything?
No, Travido systems require no action. As general guidance, CERT-EU recommends updating PHP installations to the fixed versions promptly.
How does Travido secure the chain of evidence?
Every recording is signed automatically inside the vehicle (RSA-3072 with SHA-256 per BSI TR-02102-1). Any independent party can verify authenticity with standard tools.
Sources: PHP project (php.net), announcement of October 20, 2026 and security advisory of October 21, 2026 · CERT-EU Security Advisory 2026-018.
Questions from your IT security team?
We’ll answer them directly – write to us at info@travido.gmbh.
Get in touch