Johnson Controls Updates PHP2Shell Guidance with Product Fixes
Tech GuruQuick Answer
Johnson Controls JCI-PSA-2026-24 v3 adds product-specific PHP2Shell fixes for CEM AC2000, Visonic PowerManage, and listed Illustra cameras. Inventory exact models and builds, obtain the supported patch, validate safety and service behavior, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory AC2000 deployments, PowerManage servers, listed Illustra camera models, exact versions and builds, web-interface exposure, safety dependencies, owners, backups, and maintenance windows. Match each asset to the v3 product table; do not infer that every Johnson Controls product or every PHP-based interface is affected. Obtain and apply the advisory-listed CEM hotfix, PowerManage 5.0.45, or the exact model-specific Illustra patch through the supported Johnson Controls or distributor channel. Confirm the installed build, validate authentication, video, access-control, alarm and integration workflows as applicable, review unusual web requests or PHP errors where exposure existed, and retain package and change evidence.
Last verified: 2026-10-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | CEM AC2000, Visonic PowerManage, and listed Illustra camera products |
|---|---|
| Advisory | JCI-PSA-2026-24 v3 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-27 14:13:39 UTC |
| Authority revision date | 2026-10-27 14:13:39 UTC |
| Affected versions | CEM AC2000 10.5 through 12.2, Visonic PowerManage before 5.0.45, and the advisory-listed Illustra Pro Gen4, Flex Gen4, and Pro Gen5 models before their model-specific patch builds. |
| Fixed version | CEM's advisory hotfix for the deployed AC2000 branch; PowerManage 5.0.45; or the model-specific Illustra SS016/SS010/SS017/SS024/SS018/SS022/SS025 build listed in JCI-PSA-2026-24 v3 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Johnson Controls does not state that these vulnerabilities are being maliciously exploited against its products.; no exploitation claim is inferred. |
What Changed
Johnson Controls v3 added CEM AC2000 hotfixes and clarified Illustra product names and fixed builds in its ongoing PHP2Shell product assessment.
What To Validate Now
- Inventory. Inventory AC2000 deployments, PowerManage servers, listed Illustra camera models, exact versions and builds, web-interface exposure, safety dependencies, owners, backups, and maintenance windows.
- Establish applicability. Match each asset to the v3 product table; do not infer that every Johnson Controls product or every PHP-based interface is affected.
- Remediate. Obtain and apply the advisory-listed CEM hotfix, PowerManage 5.0.45, or the exact model-specific Illustra patch through the supported Johnson Controls or distributor channel.
- Validate. Confirm the installed build, validate authentication, video, access-control, alarm and integration workflows as applicable, review unusual web requests or PHP errors where exposure existed, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
These products can support physical-security and operational functions. Coordinate with the accountable facility or safety owner, preserve configuration and evidence, and do not apply a build intended for another model.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
