This notice describes how the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619) affect our products and services, and what we are doing about them.

1.Products installed in customer environments

The products listed below do not contain PHP, so these vulnerabilities do not affect them.

Customers do not need to take any action in their own environments.

Asprova / Asprova NLS / My Schedule / Auto MPS / Auto BatchProcess / Easy Master

2.Servers operated by Asprova

Our products connect to servers that we operate for online license authentication, display language resources and news retrieval.
We have already applied mitigations to these servers, including our website, based on publicly available information, and we are now applying the patched version.
So far we have found no unauthorized access caused by these vulnerabilities.
If you cannot connect to the online license authentication server, you can keep using the products for 14 days after your last successful authentication.

3.Next steps

We will update this page once the patched version has been fully applied.

Revision history: October 22, 2026: first report