CriticalCVE-2026-109618
PHP2Shell: unauthenticated remote code execution in PHP web stacks
Actively exploited PHP flaw: unauthenticated remote code execution, validated on Apache mod_php. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Oct 28, 2026
Building systems security
A BMS runs heating, air conditioning and hot water across the property, sometimes access and lighting too. It is a network almost nobody patches, integrator remote accesses nobody re-checks, and controllers designed to live fifteen years. This page collects everything our watch publishes about these systems and about physical access control, which shares their integrators and their neglected maintenance.
Critical advisories
CriticalCVE-2026-37719
dormakaba evolo Service: unauthenticated SYSTEM RCE (CVE-2026-37719)
An attacker who reaches the internal network can run code as SYSTEM in dormakaba evolo Service, the access-control programming backend. No patch exists.
Oct 28, 2026
HighCVE-2026-71456
Kantech EntraPass: a hard-coded key in JCI access control
Johnson Controls patched a hard-coded cryptographic key in Kantech EntraPass, its door access control software. Fix in version 9.20; no known exploitation.
Oct 28, 2026
Analysis
Hotel door locks: from the 2012 Onity flaw to SALTO CVEs
A probe on a service port opened Onity hotel locks in 2012. Four SALTO ProAccess SPACE CVEs show physical security is still the weak layer in hotels.
Oct 27, 20264 min read
Unsaflok and the MIFARE backdoor: hotel keycards cloned in minutes
Unsaflok opened any Dormakaba Saflok hotel lock with two forged cards. A separate hardware backdoor hits MIFARE Classic cards used in hotels worldwide.
Oct 27, 20264 min read
Equipment makers under watch
- Johnson Controls (Metasys, American Dynamics ADVMS)
- Honeywell (N4, Comfort, Inncom)
- Trane (Tracer)
- Siemens (Desigo)
- Schneider Electric (EcoStruxure)
- Sauter
- Dormakaba, Allegion, Salto, Onity (access control)
- Kantech (Entrapass), Aisworth, Regulvar, Sunbelt Controls
First moves
- Ask the BMS integrator for the list of active remote access paths, and cut the dormant ones.
- Confirm the technical network is unreachable from the guest wifi.
- Demand a written patch schedule, with a named owner for updates.
- Back up controller configurations, not only the servers.
- For any critical vulnerability, know who disconnects what and how to fall back to manual operation.
This page is maintained automatically: every advisory and article touching building automation or access systems appears here on the day it is published. The cited sources remain the only references that count.