Issue of Oct 29, 2026

Flaws worth knowing

Dell PowerProtect Data Domain: root access with no credentials (CVE-2026-86400). The record published October 28, 2026 in Dell bulletin DSA-2026-416 describes an improper authentication flaw letting a remote, unauthenticated attacker run arbitrary commands as root on the backup appliance. Dell scores it 9.8 on CVSS 3.1; NVD still has analysis pending. Four of the bulletin's seven critical flaws need no account at all. Affected: Feature Release 7.7.1.0 through 8.8 plus the LTS2024, LTS2025 and LTS2026 branches. No exploitation reported so far; backup is a hotel's last line of defense, so this patch does not wait for the quarterly window.

WordPress 7.1.4: remote code execution hides in the upgrade window. The security release published October 28, 2026 fixes 22 flaws across 17 advisories, including a weakness in the core's update process that allows remote code execution during the upgrade window, plus a batch of stored XSS, notably in the Interactivity API. Hotel microsites carry double exposure, core and booking plugins: updating the core does not update plugins, so do both in one pass.

PHP2Shell: a serious report, still unconfirmed. Dream Research reported on October 26 and 28 a campaign that rooted 25 servers, three of them in a US government-affiliated environment, chaining PHP2Shell (CVE-2026-109618, CVE-2026-109619) with Fragnesia (CVE-2026-46300, a Linux kernel privilege escalation) using a custom-built weapon aimed at an unnamed firewall vendor. The firm names no victim, and no organization has confirmed a compromise; attribution is unconfirmed. The established part: CISA treats PHP2Shell as actively exploited. Hotel reflex: current PHP versions, admin consoles never exposed.

Trends

Oracle back offices in the crosshairs. Exploratory exploit attempts against CVE-2026-101767, an unauthenticated SQL injection chaining to remote code execution in Oracle E-Business Suite (9.8), were recorded from October 27, and the Canadian Centre for Cyber Security flagged the flaw as exploited in the wild in its October 28 update. The same day, researchers detailed the three-flaw chain behind CVE-2026-35273, the PeopleSoft entry point exploited since May. Hotel groups running Oracle's enterprise suite: apply the October corrective releases and keep EBS and PeopleSoft consoles off any reachable network.

Guest Wi-Fi under patch load. HPE published bulletin HPESBNW05162 on October 22: 72 flaws fixed in ArubaOS 8 and 10, eight of them scoring 10.0, remote code execution or authentication bypass on controllers, gateways and access points, the standard kit of hotel guest networks. Press coverage spread on October 27 and 28, late relative to the risk. Fixed releases: 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2. On the Cisco side, the October 28 revision of the PHP2Shell advisory adds Expressway, fixed in 15.5.21, and confirms ISE Portal Builder remains offline for remediation.

On the wire

OPNsense: two local privilege escalations a day apart. Two GitHub advisories, published October 28 and 29: root command injection through the firmware mirror URL (CVSS 7.2, requires the System: Firmware privilege) and OpenVPN directives smuggled inside an imported certificate (CVSS 6.4). Version 26.7.8 fixes both. Hotels running OPNsense as their firewall should update and cut the list of accounts holding the firmware privilege to the strict minimum.

Ransomware and BMS: a quiet week. Hospitality-tagged leak-site monitoring logged no claim against a structural hotel operator between October 26 and 29, and this week's CISA ICS advisories name neither Johnson Controls Metasys, nor Honeywell Inncom, nor Trane. A window worth spending on the ArubaOS and Data Domain patches above.