Issue of Oct 30, 2026

Flaws worth knowing

Cisco ASA/FTD: the SSL VPN taken down, active exploitation confirmed (CVE-2026-76418). Cisco's advisory, published October 28, 2026, targets the Remote Access SSL VPN service in ASA and Secure Firewall Threat Defense software: a NULL pointer dereference (CWE-690) triggered by a crafted request to a tunnel group configured with secondary authentication, forcing the firewall to reload. Cisco scores it 8.6 and ships no workaround: the only temporary defense is removing secondary authentication from every tunnel group, DefaultWEBVPNGroup included. CISA added it to the KEV catalog on October 29. Hotel perimeter firewalls and VPN concentrators: the fixed release outranks the next maintenance window.

PHP2Shell: Palo Alto Networks confirms exploitation on its own management interfaces. In an advisory updated October 28, the vendor reports active exploitation of PHP2Shell (CVE-2026-109618, CVE-2026-109619) against internet-exposed PAN-OS management interfaces, limited to the HTTPS web UI and the XML API service. No special configuration is required to be at risk: exposure is the trigger. Hotfixes are landing branch by branch, some due as late as October 30; the vendor states that patched customers, and those keeping management off the public internet, are not affected. House rule: no admin console reachable from the WAN side.

Hotel WordPress microsites: a run of 9.8 flaws in booking and membership tools. Three disclosures converge between October 27 and 29: an authentication bypass leading to account takeover in Qode Membership up to 2.0.6.2 (CVE-2026-92885, 9.8), a Twitter/X social-login bypass in Jupiter X Core up to 4.61.0 (CVE-2026-106013, 9.8), and an insecure direct object reference in the Hotel Booking plugin up to 3.8 that hands any logged-in user other guests' bookings: name, email, phone, address (CVE-2026-118084). The plugin, already closed in the official directory, has no announced fix. October 28 added an 8.8 CSRF and a blind SQL injection in VikRentCar. Inventory plugins, delete what nobody maintains.

Trends

Inter-property WANs in the APT crosshairs. Cisco Talos published the KeyDrift framework on October 28: the group tracked as UAT-11473, whose infrastructure overlaps Volt Typhoon, exploited CVE-2026-20127 (10.0, patched in February) against Catalyst SD-WAN controllers to plant persistence, intercept decrypted control-plane traffic and harvest IPsec keying material. Lumen separately documented Silent Train, a disposable relay network built from compromised routers and edge devices, tied to at least four zero-days. Groups linking properties over Cisco SD-WAN: verify the February patch actually deployed, and hunt for suspicious vmanage-admin logins in auth logs.

Authentication is the soft spot of the hotel web stack. This week's WordPress batch strikes identity components directly: a social-login handler, the Two Factor Authentication and All-In-One Security pair whose code is not bound to the account being logged into (CVE-2026-111739, published October 29), and membership systems. The pattern is clear: online hotel booking runs on trust in sessions, and sessions are what attackers break. Patch authentication before cosmetics, and remove unused social-login extensions.

On the wire

UEFI: a sixteen-year-old server flaw exposed (CVE-2026-97631). Publicly disclosed October 28, an out-of-bounds write in the PXE boot driver of EDK II firmware, present across much of the datacenter and cloud hosting fleet: an attacker positioned on the network can execute code before the operating system, therefore before Secure Boot, by sending a malformed ICMP message while a victim network-boots. CVSS 4.0: 9.5. The upstream fix merged October 15; vendor firmware updates are largely pending. Hotels running on-site hardware: disable network boot where possible and defer reboots until firmware is current.

GitLab enters the KEV, the IT-provider angle. CISA added on October 29 an unauthenticated remote code execution flaw in GitLab Community and Enterprise Edition (CVE-2026-97229, 10.0), with attack attempts observed. Not a hospitality product, but integrators and hotel group IT pipelines run on it. Ask any provider hosting your code or automation for written confirmation the instance is patched.

Leak sites: no new hotel victim through October 30. Hospitality-focused leak-site monitoring logged no new claim against a sector operator between October 27 and 30; the most recent posts dated October 26 and were already covered. CISA's ICS advisories this week name neither Metasys, nor Inncom, nor Trane. Spend the lull on ASA, PAN-OS and ArubaOS patches.