CriticalCVE-2026-86400
Dell Data Domain: unauthenticated root RCE (CVE-2026-86400)
Dell patches a critical PowerProtect Data Domain flaw: a remote unauthenticated attacker gains root command execution. A fix ships in DSA-2026-416.
Oct 29, 2026
Critical advisories
Critical vulnerability sheets for hospitality: who is affected, how to fix, built from CERT bulletins and vendor advisories.
CriticalCVE-2026-109618
PHP2Shell: unauthenticated remote code execution in PHP web stacks
Actively exploited PHP flaw: unauthenticated remote code execution, validated on Apache mod_php. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Oct 28, 2026
CriticalCVE-2026-111497
Brotli2Shell: Brotli decoder remote code execution (CVE-2026-111497)
The Brotli decoder in Node.js, .NET and Python allows code execution via crafted compressed streams. Active exploitation observed; CISA due date Nov. 10.
Oct 28, 2026
CriticalCVE-2026-37719
dormakaba evolo Service: unauthenticated SYSTEM RCE (CVE-2026-37719)
An attacker who reaches the internal network can run code as SYSTEM in dormakaba evolo Service, the access-control programming backend. No patch exists.
Oct 28, 2026
HighCVE-2026-71456
Kantech EntraPass: a hard-coded key in JCI access control
Johnson Controls patched a hard-coded cryptographic key in Kantech EntraPass, its door access control software. Fix in version 9.20; no known exploitation.
Oct 28, 2026
MediumCVE-2019-15126
Kr00K: hotel Wi-Fi still leaks guest data (CVE-2019-15126)
The Kr00K flaw lets attackers decrypt Wi-Fi frames after a disconnect on Broadcom and Cypress chips. Patches exist, but hotel fleets remain exposed.
Oct 27, 2026
CriticalCVE-2023-22087
OPERA PMS: critical access-control flaw (CVE-2023-22087)
An authentication flaw in OPERA 5 Property Services lets a low-privileged attacker over HTTP take full control of the PMS. Patched since October 2023.
Oct 27, 2026