Issue of Nov 4, 2026

Flaws worth knowing

Cisco Secure Email Gateway: an unauthenticated root flaw, with malicious activity detected. CVE-2026-76461 (CVSS 9.8): a crafted email triggers SQL injection in the message parser and runs as root on the underlying operating system. Advisory cisco-sa-esa-inj-2bLVGmhX reached final version 1.2 on November 3: there is no workaround, only the fixed AsyncOS release protects. Cisco says it directly contacted Secure Email Cloud customers on which malicious activity was detected. To check your own logs: search mail logs for COPY statements writing TO PROGRAM. A group's mail gateway carries reservation confirmations and guest correspondence, so patch it before the holiday season. Detailed advisory published today.

Linux: a hole in the TCP code rated 9.8 by the kernel's own CVE team. CVE-2026-98432: a race condition frees the memory of IPv4 options (Record Route, Timestamp) too early while incoming TCP connections are being processed, present since kernel 4.4, reachable with no credentials and no user interaction. Red Hat raised its rating from 5.9 to 9.8 and shipped errata between November 1 and 3, reboot required; its November 3 bulletin offers an nftables rule dropping packets with IP options as an interim mitigation. Ubuntu LTS fixes are still stuck in the testing pocket. PMS back ends, booking pages, Wi-Fi controllers: the entire Linux estate is in scope.

Siemens IoT2050: the 10-out-of-10 gateway now exploited in the wild. CVE-2026-58115: an unauthenticated Node-RED web interface lets anyone run commands as root on SIMATIC IoT2050 Advanced gateways running Industrial OS before V4.3.4.1. Honeypots captured Linux bot implants and persistent command channels from October 30 onward. Siemens has published firmware and advisory SSA-834709 since August, but nothing self-heals: devices stay exposed until someone upgrades. These gateways ship inside plant-room and refrigeration integrator kits.

Trends

The upgrade window is now an exploited vulnerability. CISA confirmed the KEV catalog addition of CVE-2026-119977 on November 3: the WordPress core race condition that exposes the unpacked installer under wp-content/upgrade for a few seconds, under active exploitation. The playbook is the one from yesterday's advisory: block web access to the staging directory before every version bump, update outside business hours. Hotel microsites, updated in batches with no maintenance window, are the most exposed profile.

Booking data is becoming the phishing lever. Three stories this week say the same thing: Amadeus is notifying customers one by one, customers of RMS Cloud in Australia get messages quoting real reservations to "re-verify" a card, and the leak-site claim against IHG describes folio and loyalty records. No need to steal the card when you already know the stay. Brief front desks on reservation-themed phishing and require a callback to the official number for any change.

On the wire

Amadeus: the disclosure wave grows. Singapore Airlines reported on November 3 that about 46,000 booking records were accessed through the platform, 620 of them holding email, phone, travel-document details and KrisFlyer numbers. Japan Airlines and ANA communicated figures in the tens of thousands early this week; Qantas confirmed it was notified and reported the case to Australian authorities. Amadeus maintains the access was read-only, limited to a booking-display environment between August 2023 and September 2026, with no payment data. The hotel side of the exposure is still unquantified by the operator.

IHG: a claim, not a confirmation. The BYOD group, active since September, posted on November 3 claiming access to customer data, folios, loyalty records and AWS keys across the IHG estate (Holiday Inn, Crowne Plaza, Six Senses) through a weakened LDAP binding password. No evidence has been published and IHG has not confirmed an incident; Cyber Daily counts 69 Australian properties. If substantiated, booking and loyalty data would fuel phishing at scale: prepare, and do not relay the claim to guests.

RMS Cloud: containment declared, the scams continue. The booking provider confirmed this week that its October incident is contained, while messages quoting real reservation data keep hitting guests in Australia, with the Kimberley and Tasmania named in coverage. The lesson applies to every property on a third-party booking platform: the breach happens upstream, the fraudulent call or text arrives in your hotel's name.

Refrigeration: Ireland names the equipment. Ireland's national cyber centre published an advisory on November 3 targeting Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers: change default passwords, allow remote maintenance only over VPN, and replace end-of-life units where possible. Belgium has opened an investigation into last week's disruptions. Hotel cold rooms, cellars and spas run the same equipment families, often maintained remotely by contractors.

PHP2Shell: vendors tighten their matrices. Mitel released revision 7.0 of advisory MISA-2026-0008 on November 3: MiVoice 5000 up to R8.4 and OpenScape gateways are affected, with fixes shipped or scheduled product by product. Schneider Electric published revision 3.0 of notification SESB-2026-295-01 for its EcoStruxure lines. Two habits for hotels: keep telephony and BMS VLANs away from any direct exposure, and ask the integrator for an inventory of internet-facing web interfaces.

The cPGuard auto-update channel was weaponised. On November 2 the self-update channel of this Linux hosting security suite became the delivery vector: an injected script installed a backdoor and harvested password files, database credentials and SSH keys, exfiltrated through a licensing server. The vendor reports about 2,900 affected servers and has released version 5.88.25, which cleans the infection. On any server that received 5.88.12 through 5.88.19, rotate root, database and SSH credentials. Many hotel websites live on exactly this kind of shared hosting.