Issue of Nov 1, 2026

Flaws worth knowing

Drupal Commerce Core under active exploitation (CVE-2026-118539). Advisory SA-Contrib-2026-254, published October 30, rates the flaw "highly critical" and confirms exploitation in the wild. The module fails to protect certain routes and entity fields, producing an access bypass whose cost lands on the merchant. Every version before 2.41 (8.x-2.x branch) and before 3.3.13 (3.x branch) is affected. Hotels selling spa treatments, tickets or boutique goods through Drupal Commerce should patch now, then audit orders, refunds and any accounts created since late October. Detailed advisory sheet published today.

WordPress: the upgrade-path flaw is now under mass attack. Wordfence blocked close to 63,000 attempts in 24 hours against a core flaw fixed in WordPress 7.1.4 on October 28: unauthenticated code execution, rated 8.1, still without a CVE identifier, abusing the staging paths that become publicly reachable during a full-package core upgrade, from 4.7 through 7.1.3. Nothing new on the fix side, but the scanning is automated and live. For hotel microsites: confirm 7.1.4 or later, purge leftovers under wp-content/upgrade, and check for unexpected administrator accounts.

Linux kernel: CVE-2026-98432, remote root on MPTCP listeners. A race condition in IPv4 TCP connection setup reads memory that was already freed; Anthropic published an exploit on October 27 that turns it into remote root on any server exposing a multipath TCP listener. The kernel CVE team scores it 9.8, while Red Hat lands between 5.9 and 8.1. Amazon shipped fixes on October 24 and 29; Ubuntu and RHEL had none as of October 29. Hospitality SaaS platforms running on Linux should schedule kernel updates and inventory exposed MPTCP services.

Trends

PHP2Shell, two weeks in: the exploitation is sorting itself out. Wiz published a wrap-up on October 30, current to October 25: 52.1% of organizations still impacted, and two activity families, public proof-of-concept exploits on one side, and PHP2Shell-branded tooling on the other that uses neither flaw, relying instead on session poisoning plus a separate application-level local file inclusion. The lesson for hotels: exploit reliability depends on the PHP build and memory limits, and copycat noise riding the brand name should not obscure the real attempts.

Ransomware keeps hunting independents. The Gentlemen posted two hospitality victims on October 31: Milan restaurant group Spontini and Belmont Resorts, a boutique property in Dharamshala, India. The claims are independently unconfirmed, but weekend cadence confirms that small properties without an IT team remain preferred quarry, far from the spotlight on big chains.

On the wire

Mitel issued revision 3.0 of advisory MISA-2026-0010 (October 30): fourteen product families moved to "Not Affected", including the 6800/6900 desk phones, MiVoice Border Gateway, MiVoice Connect and Contact Center. Only OpenScape Endpoint Management remains affected, with a fix planned; exposure is rated low when the product is deployed per Mitel guidelines. MiVoice Business and MiCollab are still "Investigating". Unify Phone and CloudLink cloud tenants are already patched.

Johnson Controls published JCI-PSA-2026-31 v2 on October 30, general guidance on HTTP2Shell (Brotli, CVE-2026-111497), and bumped JCI-PSA-2026-24 on PHP2Shell to v5. The per-product matrix is not readable with our tooling, the download page sits behind a consent wall: hotels running Metasys, Kantech or American Dynamics should request the detail from their building-automation and access-control integrator.

VikRentCar: NVD assigned CVEs on October 31 to the stored XSS flaws flagged last week in Viksoft's rental module, CVE-2026-115840 (versions through 1.4.9) and CVE-2026-116548 (through 1.4.10), both scored 7.2 and fixed in versions 1.4.10 and 1.4.11. The identifiers now feed PCI compliance scans of booking microsites.