Issue of Oct 27, 2026

Flaws worth knowing

PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (critical, CVSS 9.2). Two PHP remote code execution flaws, patched in emergency on October 21, are now exploited successfully: Perplexity honeypots recorded code execution against Apache mod_php running PHP 8.4.26, and CISA added both to the KEV catalog on October 26. Amazon reports attackers began targeting them four days before patches shipped. PHP still underpins many booking portals, marketing sites and hotel back-office tools. Inventory your PHP instances, patch this week, watch egress traffic.

Trends

Two property-software breaches, one playbook: post-leak phishing. Misterbooking (Septeo) detected an intrusion on October 19 on a server used by about 1,800 hotels: guest identities and contacts, bookings, attachments, sometimes ID document copies. RMS Cloud, a booking platform used by more than 6,000 properties, is at the center of fraudulent SMS, email and WhatsApp messages citing genuine stay dates to harvest card details. Both vendors rule out full payment card data leaving their platforms. The scam works because it quotes real bookings: call the property back at its official number, never pay from a message you received.

On the wire

Confirmed ransomware at Seetelhotels. The German group, 16 properties on the Baltic coast and in Mallorca, said on October 16 that its IT team detected unauthorized access on October 10, isolated the affected systems, notified the Mecklenburg data protection authority and the regional criminal police, and cannot rule out a personal data breach. The INC Ransom group claimed the attack on October 19, alleging guest identities and passports, payment cards and accounting records. As Seetel warns: extra caution on payment emails and changed bank details.

Two claims without confirmation. Hotel DuPont in the United States (N0n, October 19) and Castle Howard Estate in the United Kingdom (Qilin, October 24) appear on leak-site trackers with no statement from the properties: treat as unverified.

Beware recycled news. A Marriott $52 million settlement circulating this week as fresh news actually dates from October 2024, per the Connecticut attorney general's release. Check the date on the source release before amplifying an alert.