Issue of Nov 5, 2026

Flaws worth knowing

HPE Networking Fabric Composer: hardcoded credentials scored 9.8. Bulletin HPESBNW05172, published November 3, covers 56 flaws in the Aruba/HPE network fabric orchestrator. The worst, CVE-2026-95731: a command-line password known to the vendor grants remote admin access with no authentication. Fixed versions: 7.4.1 and 7.3.5. France's CERT-FR relayed the bulletins on November 4 (CERTFR-2026-AVI-1451), listing remote code execution and privilege escalation among the risks. Good news: this wave touches neither ClearPass nor ArubaOS Wi-Fi controllers. Full advisory published today.

OPNsense: certificate renewal opens the door to root. CVE-2026-123025, scored 9.4 (CVSS 4.0), published November 5: the Google Cloud DNS validation module of the os-acme-client plugin, version 4.17 and earlier, interpolates declared fields into a shell command without escaping. An authenticated user entitled to issue or renew a certificate gets code execution as root. OPNsense fronts many small hotels and signs the guest-portal certificates. Until the plugin update lands: restrict entitled accounts on the admin interface and rotate the Google Cloud service key. Full advisory published today.

Apple: an old flaw becomes an exploitation obligation. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4. This WebKit flaw helps an attacker who already holds arbitrary read and write access on the device bypass Pointer Authentication, the hardware protection on Apple silicon. Apple fixed it in May 2024: iOS and iPadOS 17.5, iOS 16.7.8, macOS 14.5, Safari 17.5. Sekoia researchers described an exploitation chain using it through Safari in October. Front-desk or restaurant iPads unpatched for two years are the exposed population. US federal deadline: November 18.

Trends

The node2shell patch duty spreads to PBX and thin clients. Mitel advisory MISA-2026-0010 reached revision 5.0 on November 4: MiVoice Business up to 10.6.0.7, OpenScape SBC, Contact Center and Xpert are now listed as affected, with fixes announced and workarounds published for the SBC and the contact center; MiCollab sits in the not-affected column. On the HP side, bulletin HPSBHF04161 of November 2 covers ThinPro 8.1 and 9 thin clients, for the same Brotli library at issue. PBX and front-desk terminals: ask your integrator, in writing, for the patch calendar on both families.

Three payment rails stuttered within 48 hours. Worldpay closed its Sterling File Gateway and Integrated Payments incidents on November 3 and showed a clean November 4: the window is ending, with no security element. Adyen still carries a degradation of Tap to Pay on some iOS 27 iPhones, tied to a mobile-management upgrade workflow, identified November 2 and unresolved. Square logged two disruptions on November 4, payment acceptance then e-money, each around ninety minutes. None of these is a breach; each one stops revenue. Keep a manual takeover ready and check the processor's status page before blaming your own network.

On the wire

Amadeus: the airline-side numbers firm up. Japan Airlines disclosed on November 2 roughly 92,000 affected customers, about 2,000 of them with passport number, nationality, contacts and loyalty number; ANA cites 37,800 customers, 1,700 with personal data; Cathay Pacific counts around 53,000 bookings, over an access window from August 2023 to September 2026. Qantas referred the case to Australian authorities. Amadeus keeps repeating: read-only booking-display environment, no payment data. The hotel side still carries no figure from the operator.

IHG: the BYOD claim circulates, IHG stays silent. Australian coverage on November 4 placed 69 hotels in the country inside the claimed perimeter; Cyber Daily notes the BYOD group has since removed the data from its leak site. No evidence published, no statement from the group to date. As things stand there is nothing to relay to guests, but two answers should be drafted: the brand statement if a confirmation lands, and the booking-themed phishing wave that usually follows this kind of case.

Synology: CERT-FR issues its advisory. The French center published advisory CERTFR-2026-AVI-1435 on November 2 covering DSM, the system behind the NAS many hotels use for backups, accounting and telephony: apply the fixed versions. Ransomware campaigns exploit flaws already patched since December 2024 on outdated releases; the vendor published a per-model fixed-build matrix on November 2. Does the NAS in the utility room have an update schedule?

DreamHost: the hosting breach is confirmed. The US provider confirmed on November 4 that an intruder exploited a vulnerability in its web File Manager from August until October 23 and stole the FTP and SFTP credentials of everyone who logged in during that period; webmail sessions for some accounts were also exposed. No trace of access to billing. Plenty of hotel microsites live with hosts of this kind: rotate any reused credentials and re-check site files and mail forwarding rules back to August.