Issue of Oct 31, 2026

Flaws worth knowing

Ivanti Connect Secure: the chain to root is now complete (CVE-2026-111357, CVE-2026-118527). CISA added two flaws to its KEV catalog on October 30: a privilege escalation to root and a predictable-identifier weakness. They chain with CVE-2026-104935, the authentication bypass Volexity has been tracking in hands-on-keyboard attacks by UTA0576 since early October, against appliances that were fully patched at the time. The end state is unauthenticated remote code execution, credential theft and exfiltration. Ivanti shipped 25.1.1.3 and 22.8R2.6 on October 29; affected builds are 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier. CISA calls for immediate upgrade, a factory reset where compromise is suspected, and rotation of every credential and certificate. A VPN concentrator, at head office or on property, is a foothold, not a harmless front door.

VikRentCar and VikBooking: two more unauthenticated stored-XSS flaws two days after the first alerts. The WPScan log grew on October 30 by two entries scored 7.2, fixed in VikRentCar 1.4.10 and 1.4.11, right behind last week's 8.8 CSRF. The vendor pushed three security releases of VikBooking in one week, 1.8.17 through 1.8.19, which says the fixing is still running. Unauthenticated stored XSS on a booking page means a poisoned form harvesting the next guests who type in their details. Check whether these plugins sit on your microsite and move to 1.4.11 and 1.8.19.

OPNsense 26.7.8: the guest portal session, hijacked on the local network. Flaw CVE-2026-119425 (CVSS 5.3, advisory GHSA-864r-q4j5-5mjq published October 30) hits captive portal roaming: an attacker on the same layer-2 segment can have their own address authorized through forged gratuitous ARP bindings and ride an authenticated guest's session, on versions 26.1.6 through 26.7.7. The same 26.7.8 hotfix of October 30 also closes a root command injection via the firmware mirror URL (CVE-2026-119409, 7.2). Firewalls hosting the guest Wi-Fi portal: apply the hotfix.

Trends

Product matrices, the real map of the web-stack crisis. The PHP2Shell and node2shell families (Brotli, CVE-2026-111497, KEV'd October 27) are no longer steered by headline but line by line at each vendor. Mitel issued MISA-2026-0010 on October 28, revised October 29: OpenScape Endpoint Management affected up to R2.5.1, MiVoice Business and MiCollab still investigating, MiVoice 5000 and MX-ONE declared not affected. Barracuda Backup is fixed in 6.7.00 since October 28. HPE re-issued its umbrella bulletin HPESBNW05171 at revision 3 on October 30, Cisco its Node.js advisory at v1.3 the same day. A not-affected row is usable intelligence: it bounds what your integrator actually owes you.

Amadeus: intrusion confirmed on the airline side, nothing published for hotels. Japan Airlines and Japan Transocean Air disclosed on October 28 that Amadeus notified them on October 23 of traces of external access to reservation records between August 10, 2023 and September 23, 2026: roughly 92,000 customers, about 2,000 of them with passport numbers, nationality and contact details. No card numbers or passwords, no confirmed misuse so far. Other Asian carriers are in scope. The Amadeus group also runs hotel reservation and loyalty systems; as of this watch, no statement names hotel customers. Keep it on the short list.

On the wire

Synology: ransomware on NAS boxes frozen on old DSM builds. The vendor said in an October 29 statement that threat actors are exploiting a vulnerability patched in December 2024 (Synology-SA-24:20) against devices running end-of-life DSM versions, encrypting data and demanding ransom. Synology is also extending PHP2Shell fixes down to DSM 6.2 and urges immediate updates plus automatic updates switched on. In a small property, the NAS often shares a flat network with the PMS, CCTV and admin files.

ESXi: a zero-day scored 2.7, used to kill the logs. CISA added CVE-2026-41709 to the KEV catalog on October 28: a logging flaw that lets an admin account operate without leaving traces. CrowdStrike documented its October 29 use as a zero-day by Warp Panda in vCenter intrusions, deploying payloads including BrickStorm and GuestConduit. The patch has existed since July 29 (VMSA-2026-0006). On-prem virtualization running the PMS or back office: confirm the patch actually landed, and audit the historical integrity of ESXi logs, not just the patch state.