PHP2Shell: the PHP flaw hiding in hotel phones, networks and sites
Two actively exploited PHP engine flaws reach hotel appliances, networks and booking sites. Vendor status, plus a remediation plan hotels can run.
Oct 30, 20265 min read
Latest stories
9 stories
Card testing campaigns target hotel booking engines
Trustwave, Imperva and Visa document persistent stolen-card testing against hotel booking engines. A grinding wave, not one headline breach.
Oct 27, 20264 min read
Hotel door locks: from the 2012 Onity flaw to SALTO CVEs
A probe on a service port opened Onity hotel locks in 2012. Four SALTO ProAccess SPACE CVEs show physical security is still the weak layer in hotels.
Oct 27, 20264 min read
Kr00K: the Wi-Fi flaw hiding in hotel access point firmware
Kr00K (CVE-2019-15126) made Broadcom and Cypress Wi-Fi chips encrypt frames with an all-zero key. Patches shipped in 2019-2020. Open question: AP firmware.
Oct 27, 20264 min read
Marriott-Starwood: Three Breaches, an ICO Fine, a 344M-Record Order
Three Marriott-Starwood breaches, 2014-2020, touched up to 500 million guests. An £18.4M ICO fine and a $52M state settlement.
Oct 27, 20263 min read
Unsaflok and the MIFARE backdoor: hotel keycards cloned in minutes
Unsaflok opened any Dormakaba Saflok hotel lock with two forged cards. A separate hardware backdoor hits MIFARE Classic cards used in hotels worldwide.
Oct 27, 20264 min read
Oracle OPERA PMS flaws: holes at the hotel front desk
CVE-2018-2957 and CVE-2023-22087 hit Oracle OPERA, a leading hotel PMS. From data exposure to full takeover: what the patch cadence means for hotel IT.
Oct 27, 20264 min read
Otelier breach: hotel data leaked through a vendor, not an intrusion
Vendor Otelier, used by 10,000+ hotels including Marriott, Hilton and Hyatt brands, confirmed a breach. Guest reservations and personal data were exposed.
Oct 27, 20264 min read
Scattered Spider Took Down MGM and Caesars With One Phone Call
In September 2023, Scattered Spider hit MGM and Caesars through help-desk vishing. Over $100 million in losses, a 10-day outage and a $45 million settlement.
Oct 27, 20263 min read