Issue of Nov 2, 2026

Flaws worth knowing

Gravity Forms: critical PHP object injection on microsites (CVE-2026-103039). Wordfence disclosed on October 30 a flaw rated 9.8 in Gravity Forms, the most widely deployed forms plugin in WordPress. Every version through 3.1.2 is affected: a List-type custom post field passes visitor input to an unrestricted deserialization routine, letting an unauthenticated visitor inject PHP objects. Code execution becomes possible when another plugin or theme supplies the gadget chain, or on hosts meeting specific conditions. The 3.1.3 fix shipped in early October. Properties collecting quotes or event bookings through Gravity Forms should confirm the installed version. Detailed advisory sheet published today.

Dell OpenManage: command injection in the server management console. On October 30 NVD published sixteen CVEs from advisory DSA-2026-467, including two OS command injections scored 8.8 (CVE-2026-111505 and CVE-2026-91913). OpenManage Enterprise drives the PowerEdge fleets many properties run their property management system and back-office workloads on: a low-privileged attacker with network access can reach command execution on the console, then pivot to every managed host. Version 4.8.0 fixes the whole set. No exploitation has been reported. Detailed advisory sheet published today.

Ivanti Connect Secure: the three-flaw chain nears its federal deadline. Write-ups published October 31 detail the chain Volexity documented: an authentication bypass (CVE-2026-104935), a remote file write and a privilege escalation combine into unauthenticated root code execution. Two of the three flaws joined CISA's KEV catalog on October 30, with a federal fix deadline of November 2 for CVE-2026-111357. The actor, previously undocumented, harvests credentials and Active Directory metadata rather than dropping web shells. Hotel groups running ICS VPNs should verify upgrade status and run the vendor's integrity checker.

Trends

PHP deserialization is becoming the microsite attack lane. After last week's WordPress wave, nearly 63,000 attempts in 24 hours against a core flaw fixed in 7.1.4, Gravity Forms and a batch of themes picked up PHP object-injection CVEs in late October, most rated 9.8 and reachable without credentials. The mechanism is the same every time: visitor data deserialized without a guard. For hotel microsites with no patch process, the checklist is unchanged: inventory the plugins, keep versions current, distrust hosts that defer upgrades.

Amadeus: the disclosure wave raises a hotel-side question. After Japan Airlines late October, Cathay Pacific confirmed on October 30 that roughly 53,000 bookings were accessed through an Amadeus system account between August 2023 and September 2026; Malaysia Airlines is now assessing its own exposure. The victims have a thread in common: abused legitimate credentials on a booking-display environment, not a brute-force intrusion. Amadeus says it fixed the display vulnerability and rotated passwords, while staying silent on the hospitality side of its platform. Properties distributing inventory through Amadeus are entitled to an explicit statement.

On the wire

Cisco moved its eMudhra certificate-authority advisory to revision 1.5 on October 30: eight intermediate CA keys were compromised, enabling fraudulent TLS certificates and man-in-the-middle risk. The remediation matrix covers ISE (3.5P5 expected in December), Unified CM and Meraki. Properties using eMudhra-issued certificates, common in the Indian market, should plan for the browser trust removals already underway.

Adyen has reported elevated error rates on its Givex gift-card and loyalty integration since October 31, with no resolution posted as of November 2. This is a continuity item, not a breach: hotels, spas and resorts accepting Givex cards through Adyen may see declined redemptions at the desk. Track the vendor status page.

Further reading: our operational feature "Alberta froze its clocks: a hotel systems action plan", published today in the Guest tech section, walks through the checks to run property by property after Alberta dropped the clock change.