Issue of Nov 8, 2026

Flaws worth knowing

Hisense VIDAA TVs: the remote control is unlocked inside the room. CVE-2026-123998, scored 8.3 and published to NVD on November 6: the VIDAA firmware exposes a remote-control MQTT service on TCP port 36669 that accepts publicly documented default credentials, with an authentication path that can be bypassed. Anyone on the network, including wherever segmentation is loose, can take over the room TV and use it as a foothold. Hospitality fleets running Hisense sets are affected by design. Until the vendor ships a fix: put televisions in a dedicated VLAN and block port 36669 between that VLAN and the rest of the network, guest Wi-Fi included.

Sophos firewall: the kernel hotfix is here, and it wants a reboot. Sophos released an out-of-cycle hotfix on November 6 for CVE-2026-98432, the TCP stack race condition the kernel maintainer scored 9.8 and we covered on November 4. It applies to SFOS 23.0 GA, 23.0 EAP1 and 22.0 MR3, and installing it requires a firewall restart; older builds must first upgrade to one of those branches to receive it. SD-RED 20/60 units are fixed in firmware 3.0.012. Sophos is not aware of exploitation in the wild. Schedule the outage for low-occupancy hours: front desk, PMS and access controllers all ride through the box.

Trends

Fortinet: patch wave lands Tuesday November 10, a natural moment for the FortiBleed cleanup. The vendor has pre-announced PSIRT advisories covering FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 plus FortiManager and FortiAnalyzer. The timing helps: in the FortiBleed credential campaign, flagged by the FBI and Secret Service with more than 86,644 devices confirmed by SOCRadar, attackers delete or reset administrator accounts and lock owners out. Before you install: hunt for unknown admin accounts, terminate active admin and VPN sessions, reset passwords, and turn on phishing-resistant multi-factor authentication. This is an action reminder, not this week's news.

On the wire

WorkOS: update on the October 30 incident. The authentication provider for business applications, used by hotel software platforms for single sign-on, published a fuller investigation report on November 6: unauthorized access to an internal sales application, CRM data involved, technical indicators provided. Production services and the authentication path remain unaffected and no customer is named. Integrators who depend on WorkOS should keep the bulletin on file; no urgent action at this stage.

IHG and Omni: still no confirmation, no denial. The BYOD claim against IHG (alleged weak LDAP password, November 4-5) and Redact's Omni Hotels listing (1.4 TB claimed, November 5) have drawn no statement from either group as of November 8, and no public proof has surfaced. These remain claims. Prudence still pays: prep guest-facing anti-phishing guidance and watch for brand impersonation, which often trails rumors like these.