Resolved critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109169.
ASP 2.9.2
Enhancements and Changes
Added static time-zone support for America/Winnipeg, America/Vancouver, and America/Edmonton, allowing these time zones to operate without Daylight Saving Time (DST) adjustments.
Improved database data retention and cleanup mechanisms.
Improved the captive portal consent flow and layout to ensure users review and accept the required consent before connecting.
Added search functionality to the site selection interface used for Duplicate Backup, making it easier to locate sites in environments with large numbers of sites.
Fixed an issue where report downloads under Global Account could remain stuck in the GUI.
Added a new Access Code Usage Report to provide usage information for access codes.
Enhanced ASP Site Management by allowing the Site Description field to be resized, making longer descriptions easier to view and edit.
Enhanced Global Plans to support configuration of the device sharing limit across all supported plan types.
Bug Fixes
Fixed an issue in PMS authentication configuration that prevented added non-VIP plans from being removed.
Fixed an issue affecting the responsiveness of Social Login buttons on the Captive Portal.
Fixed an issue in the RMS Cloud REST API PMS integration where VIP authentication could return a “Guest Not Found” error when authenticating using the guest’s last name.
Fixed an issue in ASP Admin Site Management where the site address could be displayed incorrectly or be missing from the Home Page.
Fixed an issue affecting scheduled report generation and transfer for some organizations.
Fixed an issue where repeatedly selecting Send Email on the Captive Portal could result in multiple OTP emails being sent.
Updated the ASP Transaction page so that an unavailable Billing ID is displayed as an empty value instead of “0”.
Improved the non-VIP plan upgrade confirmation popup by providing clearer Yes and No action buttons.
Fixed a time discrepancy between information displayed in the ASP GUI and downloaded reports.
Fixed an ASP permission issue where restricted Delete Expired Global Account and Delete Expired Global Code options could remain visible in the GUI.
Fixed an issue where an incorrect session end time could be displayed in the Session Report
Fixed an issue where attempting to edit a non-existent Global Plan returned a 500 Internal Server Error instead of a 404 Not Found response.
Improved site deletion processing by handling delete operations asynchronously, reducing the possibility of Gateway Timeout errors when deleting sites.
Improved the responsiveness of report and diagnostic pages by preventing administrative sessions from being locked during long-running requests.
Fixed an issue where the name and email address of users authenticated through social media were not displayed in User Details.
Security Fixes
Updated OpenSSH components to address the following security vulnerabilities;
CVE-2025-32728
CVE-2025-61984
CVE-2025-61985
CVE-2026-35414
CVE-2026-35386
CVE-2026-35385
CVE-2026-35387
CVE-2026-35388
ASP 2.9.1
Bug Fixes
Fixed an issue where the header row was missing from the downloaded monthly license usage report.
Fixed an issue where checking the casting report resulted in a 500 Internal Server Error.
Fixed an issue where the Org Super Admin could not see a newly created site.
Fixed a “404 Not Found” error when downloading reports from Report & Analytics > Downloads.
Fixed an issue where the Terms and Conditions consent popup did not support scrolling for long content.
APIs
Fixed an issue where the Org Super Admin could not see a newly created site.
ASP 2.9.0
Enhancements and Changes
Added terminal access to the cast server, enabling access from the ASP GUI.
Added an option in the GUI to end guest sessions from the server side.
Added a timezone field to the organization add and edit form.
Added a new menu switcher in the ASP GUI to navigate between different hospitality services.
Added a description field in the site list, allowing users to add notes for each site.
Bug Fixes
Fixed an issue where the TruAuth Report service would repeatedly restart due to an internal error.
Fixed an issue causing duplicate OTP emails to be sent.
Fixed an issue where the client logo was not displayed in OTP emails.
Fixed an issue where the built-in portal background image did not display after uploading a new image.
Fixed an issue where the location portal welcome page banner could not be disabled or removed once enabled.
Fixed an issue preventing custom landing page configuration when HTTPS was enabled, which caused portal save failures.
Fixed an issue where background images and icons uploaded for TV display were not taking effect.
APIs
Introduced new APIs to manage VLANs, including creating, updating, deleting, and retrieving single or multiple VLANs.
Added new APIs to manage plans, allowing users to create, update, delete, and retrieve individual or all plans.
Added new APIs to duplicate and delete locations.
Added a new API to duplicate a site and check duplication status.
Added a new API to update room devices.
Enhanced the API for retrieving all portals to include additional output fields for site name and zone.
Added a timezone field in the Organization Add, Update, Get, and Get All APIs.
Added static time-zone support for America/Winnipeg, America/Vancouver, and America/Edmonton, allowing these time zones to operate without Daylight Saving Time (DST) adjustments.
Improved database data retention and cleanup mechanisms.
Improved the captive portal consent flow and layout to ensure users review and accept the required consent before connecting.
Added search functionality to the site selection interface used for Duplicate Backup, making it easier to locate sites in environments with large numbers of sites.
Fixed an issue where report downloads under Global Account could remain stuck in the GUI.
Added a new Access Code Usage Report to provide usage information for access codes.
Enhanced ASP Site Management by allowing the Site Description field to be resized, making longer descriptions easier to view and edit.
Enhanced Global Plans to support configuration of the device sharing limit across all supported plan types.
Bug Fixes
Fixed an issue in PMS authentication configuration that prevented added non-VIP plans from being removed.
Fixed an issue affecting the responsiveness of Social Login buttons on the Captive Portal.
Fixed an issue in the RMS Cloud REST API PMS integration where VIP authentication could return a “Guest Not Found” error when authenticating using the guest’s last name.
Fixed an issue in ASP Admin Site Management where the site address could be displayed incorrectly or be missing from the Home Page.
Fixed an issue affecting scheduled report generation and transfer for some organizations.
Fixed an issue where repeatedly selecting Send Email on the Captive Portal could result in multiple OTP emails being sent.
Updated the ASP Transaction page so that an unavailable Billing ID is displayed as an empty value instead of “0”.
Improved the non-VIP plan upgrade confirmation popup by providing clearer Yes and No action buttons.
Fixed a time discrepancy between information displayed in the ASP GUI and downloaded reports.
Fixed an ASP permission issue where restricted Delete Expired Global Account and Delete Expired Global Code options could remain visible in the GUI.
Fixed an issue where an incorrect session end time could be displayed in the Session Report
Fixed an issue where attempting to edit a non-existent Global Plan returned a 500 Internal Server Error instead of a 404 Not Found response.
Improved site deletion processing by handling delete operations asynchronously, reducing the possibility of Gateway Timeout errors when deleting sites.
Improved the responsiveness of report and diagnostic pages by preventing administrative sessions from being locked during long-running requests.
Fixed an issue where the name and email address of users authenticated through social media were not displayed in User Details.
Security Fixes
Updated OpenSSH components to address the following security vulnerabilities;
CVE-2025-32728
CVE-2025-61984
CVE-2025-61985
CVE-2026-35414
CVE-2026-35386
CVE-2026-35385
CVE-2026-35387
CVE-2026-35388
ASP 2.9.1
Bug Fixes
Fixed an issue where the header row was missing from the downloaded monthly license usage report.
Fixed an issue where checking the casting report resulted in a 500 Internal Server Error.
Fixed an issue where the Org Super Admin could not see a newly created site.
Fixed a “404 Not Found” error when downloading reports from Report & Analytics > Downloads.
Fixed an issue where the Terms and Conditions consent popup did not support scrolling for long content.
APIs
Fixed an issue where the Org Super Admin could not see a newly created site.
ASP 2.9.0
Enhancements and Changes
Added terminal access to the cast server, enabling access from the ASP GUI.
Added an option in the GUI to end guest sessions from the server side.
Added a timezone field to the organization add and edit form.
Added a new menu switcher in the ASP GUI to navigate between different hospitality services.
Added a description field in the site list, allowing users to add notes for each site.
Bug Fixes
Fixed an issue where the TruAuth Report service would repeatedly restart due to an internal error.
Fixed an issue causing duplicate OTP emails to be sent.
Fixed an issue where the client logo was not displayed in OTP emails.
Fixed an issue where the built-in portal background image did not display after uploading a new image.
Fixed an issue where the location portal welcome page banner could not be disabled or removed once enabled.
Fixed an issue preventing custom landing page configuration when HTTPS was enabled, which caused portal save failures.
Fixed an issue where background images and icons uploaded for TV display were not taking effect.
APIs
Introduced new APIs to manage VLANs, including creating, updating, deleting, and retrieving single or multiple VLANs.
Added new APIs to manage plans, allowing users to create, update, delete, and retrieve individual or all plans.
Added new APIs to duplicate and delete locations.
Added a new API to duplicate a site and check duplication status.
Added a new API to update room devices.
Enhanced the API for retrieving all portals to include additional output fields for site name and zone.
Added a timezone field in the Organization Add, Update, Get, and Get All APIs.
• Updated core platform components and supporting libraries to improve security, stability, compatibility, and long-term maintainability.
• Added a new Allow Post Check option for the SkyTouch REST API PMS integration.
• Enhanced EzScan to capture and process Seat Number and additional scan data.
• Added Seat Number information to EzScan Reports and Analytics.
• Improved the built-in and custom portals so that the Posted Room No. field is displayed only when applicable to the selected guest authentication method.
• Added more customization options for editable portals, including:
• Logo positioning
• Background positioning
• Background color configuration
• Enhanced the portal File Manager to allow supported files to be edited directly.
• Improved multi-language support for portal sliders and advertisement components, including URL and scheduling information.
• Simplified Global Plan configuration by removing the Volume Limit toggle.
• Enhanced tunnel-related functionality for improved connectivity and operation.
• Added MEWS PMS support for guest departure processing.
• Improved system security by disabling unnecessary ICMP timestamp responses.
• Improved synchronization and management of custom portal images, URLs, and scheduling information.
Bug Fixes
• Fixed an issue where navigating to the Session Report after performing a search under a Global Account could result in an error.
• Fixed missing information in the Reports and Analytics page.
• Improved web server security by preventing unintended access to protected configuration files and reducing unnecessary server software information exposure.
• Updated SMTP handling for AWS deployments to support environments where SMTP port 25 is restricted.
• Improved the performance of retrieving purchased transaction information.
• Updated file-saving confirmation messages to make them clearer and more accurate.
• Fixed several VLAN configuration and validation issues, including errors when adding or editing VLANs.
• Fixed an issue where the EzCast server health status was not updated correctly.
• Improved scheduled report generation in redundant ASP deployments.
• Fixed an issue where user time information could be displayed incorrectly in certain forms.
ANTlabs is boldly going where no Wi-Fi has gone before
The maritime industry has long struggled with delivering reliable, high-speed internet at sea. In an era where staying connected is vital for quality of life at sea, Elcome International, a leading maritime systems integrator, partnered with SpaceX’s Starlink to offer a revolutionary satellite broadband service. At the core of this solution is ANTlabs’ SG5 Gateway and ASP Cloud Wi-Fi Services Management platform, enabling seamless connectivity and advanced bandwidth controls that are powerful and flexible for maritime vessels worldwide.
The Challenge
Providing internet connectivity at sea has traditionally been an expensive and limited endeavor. Maritime operators faced challenges such as:
High Costs: Legacy systems imposed high fees on operators and users, restricting widespread access.
Limited User Control: Absence of robust tools for bandwidth management, prepaid systems, or volume tracking caused inefficiencies.
Poor User Experience: Frequent connectivity interruptions and lack of roaming capabilities frustrated users.
Fragmented Solutions: With various Wi-Fi vendors providing access points across fleets, operators needed a unified platform capable of integrating diverse systems seamlessly.
To address these, Elcome required a robust backend solution that could pair with Starlink’s low-latency satellite service. ANTlabs delivered the critical components to make this a reality.
The Solution: ANTlabs’ Role
Elcome launched its groundbreaking “WELCOME” internet service in mid-2024, powered by Starlink’s satellite technology and ANTlabs’ Wi-Fi Services infrastructure. Officially unveiled during a press release in Dubai, the service represents a milestone for maritime connectivity with availability in all international waters and territorial waters of 70 countries. The service boasts bandwidth of up to 350 Mbps and average latency below 99ms.
ANTlabs’ Contributions
SG5 Gateways: High-performance gateway devices connecting onboard users to the Starlink satellite network. Robust security and seamless integration with Elcome’s maritime systems.
ASP Wi-Fi Services Management Platform:
Prepaid Internet Plans: Enables users to purchase data bundles or subscriptions at prices starting from $3, ensuring cost-effective access.
Efficient Volume Tracking and Analytics: Operators and users alike benefit from data updates every minute, ensuring near real-time monitoring
Roaming Capabilities: Users can retain their data plans when switching vessels.
Payment Gateway Integration: Offers seamless online payment options. Multiple payment options make access simple and stress-free, including seamless Stripe payment integration to ensure safe and secure transactions at sea.
What sets ANTlabs apart is its unique combination of deep R&D expertise and proven leadership in delivering connectivity solutions for hospitality and telecommunications industries. With over two decades of innovation, ANTlabs has been a trusted partner for hotel groups, Telcos, and ISPs, delivering scalable, user-centric solutions that set industry standards. Applying this extensive experience to the maritime sector has enabled ANTlabs to solve complex connectivity challenges with unmatched reliability and flexibility.
These solutions form the backbone of WELCOME’s service delivery, providing connectivity to over 1,500 vessels by late 2024, with plans for thousands more in 2025.
Impact and Results
Since its launch, WELCOME has significantly improved the quality of internet access for crew members at sea:
Enhanced Crew Welfare: Crew members enjoy consistent, high-speed connectivity to stay in touch with family, access entertainment, and participate in online learning.
Roaming Benefits: With WELCOME, crew members can use the data they purchase on one WELCOME-equipped vessel on another, ensuring seamless connectivity as they move between ships.
Collaborative Opportunities: Elcome plans to partner with content and service providers to extend the reach of their products via WELCOME, further enriching the crew’s experience.
Voices from the Frontline
“We are excited to introduce WELCOME, a game-changing maritime internet service that will revolutionize how ships and offshore installations stay connected at sea.”– Asneed Ameer, Senior Manager Connectivity at Elcome (Elcome International).
Key Features at a glance
High-Speed Internet: With bandwidth of up to 350 Mbps and average latency below 99ms, the WELCOME service ensures efficient communication and data transfer at sea.
Flexible Payment Options: Affordable and customizable prepaid plans starting at $3 cater to diverse user needs.
Roaming Across Vessels: Seamless connectivity for crew members who frequently change ships, ensuring they stay connected as they move.
Global Coverage: The service is available in all international waters and the territorial waters of over 70 countries.
Enhanced Crew Experience: Partnerships with content and service providers will offer additional benefits, extending access to entertainment, education, and more.
Vendor Agnostic: Seamlessly integrates with diverse Wi-Fi access solutions, enabling broad scalability across fleets.
Conclusion
ANTlabs is proud to have provided the technological foundation behind Elcome’s WELCOME service, combining advanced satellite capabilities with user-centric features. By enabling high-speed internet access, cost-effective prepaid models, and real-time management tools, ANTlabs empowers Elcome to redefine personal connectivity at sea. As the rollout continues across thousands of vessels, ANTlabs remains committed to driving innovation and supporting the maritime industry’s digital transformation. With unmatched R&D capabilities and a proven track record of solving connectivity challenges, ANTlabs stands as the technology leader uniquely equipped to deliver global-scale solutions that enhance the onboard experience for crew and passengers alike.
Full disclosure: This article was written with a little help from AI—think of it as having Lt. Data from the Starship Enterprise assist with the writing. Seamless, precise, and a bit futuristic—just like the Wi-Fi we’re rolling out across the Seven Seas!
• Implemented a monitoring system to collect, store, and analyze data from a wide range of monitored devices, systems, and services
• Upgraded Secure Remote Access Tool to version 8.8 for enhanced security and performance
• Improved portals to allow configuration of slider start and end times
• Enhanced authentication server to enable automatic database restarts
• Implemented a new full sync command to resolve the data synchronization issue
• Changed database storage engine for improved consistency
• Disable strict data mode to turn off stricter data handling and integrity checks
• Created a new scheduled task to regenerate session usage data, addressing the issue where the session usage chart was empty when a user logged out the next day
• Changed the “Airline” column to “Flight Number” in the ASP Scan Report
Bug Fixes
• Fixed Network Time Protocol configuration to ensure that all connected systems maintain accurate and consistent time
• Fixed the bug where the user device information was missing
• Fixed the issue where old authentication log files were not being cleaned up
• Fixed the issue of the user creation debug log file growing continuously and introduced an option to disable logging
• Fixed the issue of the database log file continuously growing
• Fixed the issue where the global account failed to log in the second time using the same device and access point, returning an error that the user was already logged in
• Fixed the issue that prevented the database server from starting
• Fixed the database HA failover issue
• Fixed the issue where gateway patch installation via ASP failed when the patch file was large
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
