Security Update Regarding AS1190 and Phoenix Platforms

The cybersecurity and resilience of your operations are a priority for Automatic Systems. In a spirit of transparency and collaboration, we would like to inform you of the recent disclosure of two vulnerabilities affecting PHP (Hypertext Preprocessor), a widely used component employed by numerous organizations and technology solutions worldwide.
While this situation affects a broad range of industry players, we would first like to reassure you that, immediately upon disclosure of these vulnerabilities, our R&D and Cybersecurity teams conducted a thorough assessment of their potential impact on our solutions and have been continuously monitoring the situation ever since.

We would like to inform you that these vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect a PHP component used within the AS1190 and Phoenix platforms integrated into certain Automatic Systems products.

As of October 23, 2026, no evidence of exploitation of these vulnerabilities and no security incidents affecting the concerned products or solutions have been identified.
In line with our cybersecurity policy and as a precautionary measure, our R&D and Cybersecurity teams continue to closely monitor the situation and are implementing the appropriate actions to further strengthen the security of our products.

A software update is currently being prepared for the affected platforms. We will provide detailed deployment instructions and technical information regarding these updates as soon as they become available.
In the meantime, we recommend applying the following best practices:

• Restrict access to the web interface (ports 80 and 443) to trusted networks only. If the interface is accessible from the Internet, we strongly recommend restricting or removing this access.
• Isolate the equipment on a dedicated network protected by a firewall and avoid direct exposure to the Internet.
• Remain vigilant for any unusual behavior, such as unexpected reboots, unknown files or processes, or abnormal outbound connections.

We are monitoring this situation with the utmost attention and will continue to keep you informed of any significant developments. Should you have any questions or require assistance in implementing these recommendations, our teams remain at your disposal.