10/05/2026
Locksmith Industry Brief — October 5, 2026
1. Johnson Controls EasyIO controller vulnerabilities
Johnson Controls published five EasyIO advisories on October 1, affecting EasyIO Neo, FG and FS-32 building-automation controllers. Reported issues include cleartext transmission that could expose credentials or session data, sensitive-information disclosure and inadequately protected hardware debug interfaces.
This is adjacent to access control but important in hospitals and large facilities where building automation shares networks or operational integrations.
Action:
Ask facilities/IT whether EasyIO EC, CW, FG or FS-32 controllers are installed.
Record the exact model and firmware; affected-version thresholds differ between advisories.
Keep EasyIO controllers off the access-control and general business networks wherever possible.
Obtain model-specific firmware guidance directly from Johnson Controls before updating.
After remediation, rotate controller and integration credentials that might have crossed an exposed connection.
Do not treat this as a lock failure—the locksmith’s role is identifying shared infrastructure and protecting door-system boundaries.
No confirmed active exploitation was identified in the official material reviewed.
2. New BHMA editions for low-energy operators and door hardware
BHMA now lists ANSI/BHMA A156.19-2026 as the current standard for power-assist and low-energy swinging-door operators, replacing the 2019 edition. The standard covers single doors, simultaneous pairs and dual-egress operators, including provisions intended to reduce injury and entrapment. �
buildershardware.com +1
BHMA also lists:
A156.6-2026 for protection plates, pulls, push plates, edgings and vertical-rod guards.
A156.8-2026 for overhead stops and holders.
buildershardware.com +1
Practical implications:
Update new specifications and purchasing templates that still cite A156.19-2019 or the 2021 A156.6/A156.8 editions.
For hospital operator work, document activation method, opening/closing performance, signage, safety checks and the edition used.
Verify that replacement overhead stops and holders are appropriate for the door weight, expected cycle count and abuse level.
These publications do not automatically require retrofitting existing Texas openings; contract documents, adopted codes and the AHJ still control.
3. Credential-cloning warning from cruise-vessel research
CERT/CC published research showing a cruise-vessel access installation where the reader reportedly authorized an NTAG212 credential using its UID without validating stronger card data. Brief proximity to a valid credential could therefore permit cloning. No identified manufacturer or public remediation was included, so the scope remains uncertain and should not be generalized to all hospitality systems.
For hospitality or multifamily assessments:
Ask the system manufacturer whether authorization relies on UID/CSN alone or authenticated credential data.
Do not assume a printed serial number, proprietary card appearance or data resembling a signature is actually verified by the reader.
Recommend encrypted credentials and diversified keys where supported.
Document the reader model, credential technology and vendor’s written security response before proposing wholesale replacement.
