PHP2Shell: the PHP flaw hiding in hotel phones, networks and sites
Two actively exploited PHP engine flaws reach hotel appliances, networks and booking sites. Vendor status, plus a remediation plan hotels can run.
Hospitality cybersecurity, reported in the open.
PMS, point of sale, booking engines, wifi, room keys: everything that runs a hotel is connected, and anything connected can fail. HotelSec tracks the vulnerabilities, incidents, threats and rules that matter to hotels, resorts and casinos, in French and in English.
Daily watch · Oct 30, 2026→
Cisco ASA/FTD: actively exploited SSL VPN flaw added to CISA KEV. PAN-OS: confirmed PHP2Shell attacks on exposed management interfaces.
Lead story
Latest stories
Card testing campaigns target hotel booking engines
Trustwave, Imperva and Visa document persistent stolen-card testing against hotel booking engines. A grinding wave, not one headline breach.
Oct 27, 20264 min read
Hotel door locks: from the 2012 Onity flaw to SALTO CVEs
A probe on a service port opened Onity hotel locks in 2012. Four SALTO ProAccess SPACE CVEs show physical security is still the weak layer in hotels.
Oct 27, 20264 min read
Kr00K: the Wi-Fi flaw hiding in hotel access point firmware
Kr00K (CVE-2019-15126) made Broadcom and Cypress Wi-Fi chips encrypt frames with an all-zero key. Patches shipped in 2019-2020. Open question: AP firmware.
Oct 27, 20264 min read
Marriott-Starwood: Three Breaches, an ICO Fine, a 344M-Record Order
Three Marriott-Starwood breaches, 2014-2020, touched up to 500 million guests. An £18.4M ICO fine and a $52M state settlement.
Oct 27, 20263 min read
Unsaflok and the MIFARE backdoor: hotel keycards cloned in minutes
Unsaflok opened any Dormakaba Saflok hotel lock with two forged cards. A separate hardware backdoor hits MIFARE Classic cards used in hotels worldwide.
Oct 27, 20264 min read
Oracle OPERA PMS flaws: holes at the hotel front desk
CVE-2018-2957 and CVE-2023-22087 hit Oracle OPERA, a leading hotel PMS. From data exposure to full takeover: what the patch cadence means for hotel IT.
Oct 27, 20264 min read
Otelier breach: hotel data leaked through a vendor, not an intrusion
Vendor Otelier, used by 10,000+ hotels including Marriott, Hilton and Hyatt brands, confirmed a breach. Guest reservations and personal data were exposed.
Oct 27, 20264 min read
Scattered Spider Took Down MGM and Caesars With One Phone Call
In September 2023, Scattered Spider hit MGM and Caesars through help-desk vishing. Over $100 million in losses, a 10-day outage and a $45 million settlement.
Oct 27, 20263 min read
Sections
Vulnerabilities
Weaknesses in PMS, point of sale, booking engines and connected equipment, with fixes and context explained.
Incidents
Ransomware, outages and intrusions at hotels, laid out by facts and timeline, without theatrics.
Data breaches
Leaks of guest and payment data, confirmed or under investigation, and what each case requires of operators.
Threat intel
Ransomware groups, fraud networks and campaigns aimed at hospitality, tracked as they move, described without drama.
Guest tech
Wifi, keycards, smart locks, in-room TVs and guest services: the technology guests touch, and how well it holds up.
Defense
Hardening practices, patch discipline, questions to ask vendors, and lessons from hospitality IT teams in the field.
Compliance
NIS2, GDPR, PCI DSS and ANSSI requirements: what hotels must do, what changes, and by when, reported as news, not as marketing.