0 Items

Security Advisory

Legacy PHP Components on Certain MDI Controllers

ID: MDI-SA-2026-001

Status: Remediation In Progress

Published: 10/26/2026

Updated: 10/27/2026

At A Glance

What: Outdated PHP software components are present on certain MDI controller models.

Remediation required: UDC 4500, SBC, UDC 4720, UDDC

No PHP remediation required: DDC, AZC, ORC, ACU-TS

 What to do now: Contact MDI Technical Support or your authorized MDI dealer, and restrict controller access to authorized personnel and trusted networks while remediation is pending.

Overview

Monitor Dynamics (MDI) has identified outdated PHP software components on certain controller models. Older PHP versions are no longer supported and may contain known security vulnerabilities. The presence of these components does not, by itself, establish that a system has been compromised or that a particular vulnerability is exploitable.

MDI Engineering is developing and validating remediation procedures designed to permanently remove legacy PHP components while maintaining essential controller functionality.

Am I Affected?

Find your controller model below to see its current remediation status.

Controller Model Current Status
UDC 4500 Remote (network) or Direct Connection
SBC Direct Connection method
UDC 4720 Remote (network) or Direct Connection
UDDC Remediation development in progress
DDC / AZC / ORC No PHP remediation required
ACU-TS No PHP remediation required

Network security considerations

Dedicated or isolated security networks generally reduce exposure to internet-based threats, but isolation does not eliminate all cybersecurity risk. MDI recommends implementing applicable remediation procedures regardless of internet connectivity.

Recommended Actions

  1. Contact MDI - Reach MDI Technical Support or your authorized MDI dealer for remediation availability and implementation guidance.
  2. Limit access now - Restrict controller access to authorized personnel and trusted networks while remediation is pending.
  3. Plan the work with IT - Coordinate remediation with your security and IT personnel. Temporary controller downtime or restarts may be required.

Updates & Revision History

This advisory will be updated as MDI Engineering validates and releases additional remediation procedures. Check the "Last updated" date above for the latest status.

 

Date Revision
10/26/2027 Initial Publication
10/27/2027 UDC & SBC Hot Fix Guide Release

Primary Actions

Call Technical Support

See Recommended Actions

Contact MDI Technical Support

Questions about this advisory or your controllers? Our team can confirm whether your system is affected and help schedule remediation.

Phone: (210)477-5400   ·   Email: support@mondyn.com

This advisory is provided for informational purposes and reflects MDI's understanding as of the last updated date. MDI will revise it as new information becomes available.