Black October: A Cybersecurity Guide for Hotels
Security 10/11/2026
Black October is over. What it leaves behind isn’t.
That’s the name social media gave to the latest month in cybersecurity: a string of critical vulnerabilities, emergency patches and attacks that had half the internet racing to update servers. It’s not an official name. But the feeling that it was an especially rough month is very real.
This article isn’t here to scare you. There’s plenty of that out there already. We want to help you understand where people actually get caught, what you can start doing tomorrow and how to respond if it ever happens to you. Because it can. To you, to us, to anyone.
It all kicked off on October 21. That day, the PHP team released urgent fixes for two critical flaws, dubbed PHP2Shell, rated 9.2 out of 10 for severity. PHP powers around 70% of websites, so the race to patch servers went global. Cloudflare recorded millions of attempts to exploit the flaw once it went public.
The same day brought critical patches for other widely used tools, such as Node.js and GitLab. Two days later, a third PHP-related vulnerability came to light. Add ransomware campaigns, data leaks and legitimate software tampered with to spread malware.
Let’s keep things in perspective. PHP running 70% of websites doesn’t mean 70% of websites were hacked. It means there was a lot to update, very fast.
The most important thing about Black October isn’t what happened in October. It’s the curve behind it. As of October 24, the leading vulnerability database (NVD) had logged 88,602 vulnerabilities published in 2026, nearly double the total for all of 2025. September had already set a record, with more than 15,000 in a single month.
Part of the reason is that AI is helping uncover flaws much faster. In the medium term, that’s good news, because they get fixed sooner. In the short term, it means more patches, more often, and less room to leave them for next week.
From November 3 to 5, the Barcelona Cybersecurity Congress (BCC26) devoted an entire session to hospitality. Sascha Maier, Chief Information Security Officer at SV Group, summed it up in one line.
You don’t need to break the booking engine to do damage. It’s enough to slip into any link in the chain between a hotel and its guest: a chat, an email, a WhatsApp message, a payment link, an employee’s account or a vendor’s.
SV Group’s case says it all. Its guests received WhatsApp messages with their name, their dates and real booking references. The message urged them to verify their stay right away, led to an official-looking website and ended by asking for their card or a verification payment. Anyone who hesitated got a push from fake customer support. More than 800 cases, which the session linked to booking data exposed in an OTA breach in April 2026.
Ransomware isn’t taking a break either. Five groups account for a visible share of the victims claimed in the industry. But most of them, 294 out of 462, come from many smaller groups. There’s no single enemy to keep an eye on.
Let’s be clear: if your hotel has been hit by a cyberattack, you’re not the first and you won’t be the last. Attacks stopped coming from a hooded teenager in a bedroom a long time ago. They come from organizations that work in shifts, rent out their tools by subscription and use AI to write emails without a single typo.
Falling for a well-designed scam doesn’t make you naive. It makes you human. And in a hotel, where the team is trained to solve guest requests fast, urgency is exactly the lever attackers pull hardest.
At BCC26, the reasons got a name. The front desk combines five conditions that make it the perfect target:
These are features of the job, not of the people doing it. The attacker doesn’t hack the system: they exploit the host’s hospitality. Our greatest strength, turned into their way in.
What really makes an incident worse isn’t having suffered it. It’s keeping quiet, reacting late or not knowing who to call.
Strong passwords and two-factor authentication are still essential. We covered them in a previous article. But attackers have long been looking for ways around them. These are the doors they’re using most.
When you log in to the extranet, your email or any other tool, the browser stores a session cookie so it doesn’t ask for your password every time. If information-stealing malware (infostealers) gets onto the computer, it can grab that cookie. And the attacker walks in as you. No password. No second factor.
This isn’t a one-off. A NordVPN study found more than 52.4 billion stolen cookies in a single year. The malware usually arrives the usual ways: unsafe downloads, fake updates, misleading ads or attachments.
What helps: signing out on all devices when something feels off, not leaving sessions open indefinitely on shared front desk computers and, if you suspect anything, changing credentials from a clean device. Changing your password from the infected computer is like changing the locks with the burglar still inside.
A translator, an ad blocker, a screenshot tool. Browser extensions install in one click and can access far more than you’d think. In late October, 319 malicious Chrome extensions with 13.4 million installs were identified. And a legitimate extension can change hands and start misbehaving with a simple update.
What helps: on work computers, only what’s needed. Check every so often what’s installed, what permissions it has and who added it.
An angry guest emails in. They’re complaining about bedbugs and attach the photos in a compressed file. The front desk wants to fix it fast and opens it. Microsoft has warned about a campaign running this exact script against hotel staff since April 2026. The photos aren’t photos. They’re the malware.
BCC26 showed another version of the same script. A guest with a real seven-night booking writes through the platform chat, gets a direct email address from the hotel and explains they have severe allergies to certain cleaning products. They send the list as a password-protected ZIP hosted elsewhere and suggest opening it on a Windows computer. New story. Same script.
Another well-known variant: a link to a page that mimics an OTA verification, with a fake captcha that asks you to press Windows + R, paste some text and hit Enter. If a captcha asks you to do that, it’s not a captcha. It’s an open door.
What helps: making sure the team knows urgency is a red flag, not a reason to skip steps. And that when in doubt, they verify through another channel before opening anything.
Attacks don’t stay put anymore. They start in OTA messaging, move to email and end up on WhatsApp or a fake payment page. Every jump takes the conversation onto less controlled ground.
Not even a message inside an official platform is a guarantee. If the account sending it is compromised, the interface is legitimate, but the message isn’t.
What helps: keeping a clear list of your official channels and sharing it. Anything that arrives outside of it gets verified before anyone touches it.
PHP2Shell is the perfect example. The patch was available from day one, but at the height of the crisis more than 884,000 systems were still running old, officially unsupported versions. The flaw affected many. The real risk fell on those who didn’t update.
What helps: knowing what technology sits behind your website, your email and your tools, and asking each vendor how and when they apply critical patches. You don’t need to be technical to ask that question. You do need to ask it.
Most don’t require a big budget. All of them require consistency.
One last idea from BCC26: training works best in small doses. Short, frequent sessions with real, everyday examples stick far better than a once-a-year course nobody remembers by August.
Nobody wants to put that plan to use. But if the moment comes, order matters.
Know who to contact before you need them. In the US, incidents can be reported to CISA and the FBI’s Internet Crime Complaint Center (IC3). Elsewhere, find your national equivalent ahead of time. And one last piece of advice: don’t reply to the attacker or pay any ransom without professional advice.
Direct sales rest on a simple idea: guests trust your website enough to leave their details and their card there. Every scam that circulates under a hotel’s name, yours or someone else’s, chips away a little at that trust across the whole industry.
That’s why we believe cybersecurity can’t be a race to see who’s best protected. It’s a shared effort. Attackers trade tools, password lists and stolen access. The industry should be just as generous with what matters: sharing alerts, speaking up when a campaign is spotted and treating an attacked hotel as a victim, not as a fool.
Hoteliers, chains, technology vendors, distribution channels, associations. We all have something to contribute. And we all have something to lose if we don’t.
We’re not going to tell you we’re invulnerable. Nobody is, and be wary of anyone who claims otherwise. What we can tell you is how we work to stay prepared.
Our technology is developed in-house and isn’t built on PHP, so PHP2Shell didn’t affect us directly. We’re not wearing that as a badge: the next vulnerability could show up anywhere else, which is why we never stop watching.
We also apply measures such as per-user two-factor authentication, full access traceability and alerts when a password shows up in a known public leak. We explain them in more detail in this article.
And if you have questions about the security of your direct channel, or something has landed in your inbox that doesn’t add up, get in touch. That’s what we’re here for.
Black October will go down as a bad month. What we do from now on will decide whether it was also a lesson. So our message is simple:
No one is immune. But no one has to face it alone.
That’s the name social media gave to the latest month in cybersecurity: a string of critical vulnerabilities, emergency patches and attacks that had half the internet racing to update servers. It’s not an official name. But the feeling that it was an especially rough month is very real.
This article isn’t here to scare you. There’s plenty of that out there already. We want to help you understand where people actually get caught, what you can start doing tomorrow and how to respond if it ever happens to you. Because it can. To you, to us, to anyone.
~70%
of websites run on PHP, the language hit by PHP2Shell
9.2
out of 10: the severity of PHP2Shell’s two critical flaws
×1.8
vulnerabilities published in 2026 vs. all of 2025, as of October 24
52.4B
cookies stolen by malware in a single year
Before we start
No one is immune to a cyberattack. Not your hotel, not your vendors, not us. What you can choose is how prepared you are when it comes.
What Black October was (and what it wasn’t)
It all kicked off on October 21. That day, the PHP team released urgent fixes for two critical flaws, dubbed PHP2Shell, rated 9.2 out of 10 for severity. PHP powers around 70% of websites, so the race to patch servers went global. Cloudflare recorded millions of attempts to exploit the flaw once it went public.
The same day brought critical patches for other widely used tools, such as Node.js and GitLab. Two days later, a third PHP-related vulnerability came to light. Add ransomware campaigns, data leaks and legitimate software tampered with to spread malware.
Let’s keep things in perspective. PHP running 70% of websites doesn’t mean 70% of websites were hacked. It means there was a lot to update, very fast.
Not a bad month. A trend
The most important thing about Black October isn’t what happened in October. It’s the curve behind it. As of October 24, the leading vulnerability database (NVD) had logged 88,602 vulnerabilities published in 2026, nearly double the total for all of 2025. September had already set a record, with more than 15,000 in a single month.
Part of the reason is that AI is helping uncover flaws much faster. In the medium term, that’s good news, because they get fixed sooner. In the short term, it means more patches, more often, and less room to leave them for next week.
Published vulnerabilities (CVEs)
NVD records · number of vulnerabilities
2026, through October 24
88,602
2025, full year
49,972
Source: NVD data compiled by OpenSecurity. In under ten months, 2026 is already at 1.8 times the 2025 total.
They’re not attacking the hotel anymore. They’re attacking trust
From November 3 to 5, the Barcelona Cybersecurity Congress (BCC26) devoted an entire session to hospitality. Sascha Maier, Chief Information Security Officer at SV Group, summed it up in one line.
“Criminals no longer hack the hotel. They hack the trust between hotel and guest.”
Sascha Maier, CISO at SV Group, at BCC26
3,056
weekly attacks per organization in hospitality, travel and recreation in August 2026, up 56% year over year (Check Point Research)
+800
WhatsApp phishing cases targeting the guests of a single hotel group
462
industry victims claimed by ransomware groups between January 2025 and October 2026
Ransomware isn’t taking a break either. Five groups account for a visible share of the victims claimed in the industry. But most of them, 294 out of 462, come from many smaller groups. There’s no single enemy to keep an eye on.
Industry victims claimed by ransomware groups
January 2025 to October 2026 · number of claimed victims
Other groups (combined)
294
Qilin
70
Akira
32
Play
23
DragonForce
23
The Gentlemen
20
Source: leak site data presented by SV Group at BCC26. These are victims publicly claimed by the groups themselves, not confirmed incidents. Total: 462.
It happens to the best of us
Let’s be clear: if your hotel has been hit by a cyberattack, you’re not the first and you won’t be the last. Attacks stopped coming from a hooded teenager in a bedroom a long time ago. They come from organizations that work in shifts, rent out their tools by subscription and use AI to write emails without a single typo.
Falling for a well-designed scam doesn’t make you naive. It makes you human. And in a hotel, where the team is trained to solve guest requests fast, urgency is exactly the lever attackers pull hardest.
At BCC26, the reasons got a name. The front desk combines five conditions that make it the perfect target:
High turnover
Constant pressure
Little security training
Service mindset
Links and attachments every day
What really makes an incident worse isn’t having suffered it. It’s keeping quiet, reacting late or not knowing who to call.
Bonus Tip
Cybercriminals never check in, but they try to stay the night. The sooner you spot them, the sooner you check them out.
Where people get caught (and it’s not always where you think)
Strong passwords and two-factor authentication are still essential. We covered them in a previous article. But attackers have long been looking for ways around them. These are the doors they’re using most.
The session that walks out with a cookie
When you log in to the extranet, your email or any other tool, the browser stores a session cookie so it doesn’t ask for your password every time. If information-stealing malware (infostealers) gets onto the computer, it can grab that cookie. And the attacker walks in as you. No password. No second factor.
This isn’t a one-off. A NordVPN study found more than 52.4 billion stolen cookies in a single year. The malware usually arrives the usual ways: unsafe downloads, fake updates, misleading ads or attachments.
What helps: signing out on all devices when something feels off, not leaving sessions open indefinitely on shared front desk computers and, if you suspect anything, changing credentials from a clean device. Changing your password from the infected computer is like changing the locks with the burglar still inside.
The extension that seemed useful
A translator, an ad blocker, a screenshot tool. Browser extensions install in one click and can access far more than you’d think. In late October, 319 malicious Chrome extensions with 13.4 million installs were identified. And a legitimate extension can change hands and start misbehaving with a simple update.
What helps: on work computers, only what’s needed. Check every so often what’s installed, what permissions it has and who added it.
The guest who isn’t a guest
An angry guest emails in. They’re complaining about bedbugs and attach the photos in a compressed file. The front desk wants to fix it fast and opens it. Microsoft has warned about a campaign running this exact script against hotel staff since April 2026. The photos aren’t photos. They’re the malware.
BCC26 showed another version of the same script. A guest with a real seven-night booking writes through the platform chat, gets a direct email address from the hotel and explains they have severe allergies to certain cleaning products. They send the list as a password-protected ZIP hosted elsewhere and suggest opening it on a Windows computer. New story. Same script.
Another well-known variant: a link to a page that mimics an OTA verification, with a fake captcha that asks you to press Windows + R, paste some text and hit Enter. If a captcha asks you to do that, it’s not a captcha. It’s an open door.
What helps: making sure the team knows urgency is a red flag, not a reason to skip steps. And that when in doubt, they verify through another channel before opening anything.
The conversation that switches channels
Attacks don’t stay put anymore. They start in OTA messaging, move to email and end up on WhatsApp or a fake payment page. Every jump takes the conversation onto less controlled ground.
Platform chat
→
Email
→
WhatsApp
→
Fake payment page
Red flags the front desk can spot
- Phone numbers, senders or domains that aren’t among your official channels.
- Changes to contact numbers, payment links or instructions shortly after the booking is made.
- Urgent messages asking guests to re-enter their card even though the booking is already guaranteed or paid.
- Several guests asking about the same link or the same message at the same time.
The software nobody updates
PHP2Shell is the perfect example. The patch was available from day one, but at the height of the crisis more than 884,000 systems were still running old, officially unsupported versions. The flaw affected many. The real risk fell on those who didn’t update.
What helps: knowing what technology sits behind your website, your email and your tools, and asking each vendor how and when they apply critical patches. You don’t need to be technical to ask that question. You do need to ask it.
| Way in | How it usually arrives | First line of defense |
|---|---|---|
| Session cookies | Malware that sneaks in through a download, a fake update or an attachment | Sessions that expire and sign-out on all devices at the first suspicion |
| Extensions | Seemingly useful or legitimate add-ons that change hands | Only the essentials, reviewed regularly |
| Fake guests | Urgent complaints with attachments or links to fake verifications | When it’s urgent, verify through another channel before opening anything |
| Channel switching | From platform chat to email, WhatsApp or a fake payment site | A list of official channels and no payments outside them |
| Outdated software | Known flaws still open weeks after the patch | Update, and ask each vendor how they handle patches |
Survival guide: twelve habits to start tomorrow
Most don’t require a big budget. All of them require consistency.
Access: who gets in, with what and how far
01
Two-factor, always
On the extranet, email, booking engine, PMS and payment gateway. No exceptions. It’s not foolproof, but without it the door is left ajar.
02
One person, one account
If five people share "frontdesk1", when something goes wrong nobody knows who did it or from where. Without named accounts, there’s no traceability.
03
Least privilege
Each user gets access only to what their job requires. If an account falls, the damage stays within its perimeter.
04
Different passwords
One per service, especially for your vendor logins: booking engine, PMS, payment gateway. If one falls, the rest don’t go with it.
05
Formal offboarding
When someone leaves the hotel, their access leaves with them. Same day, with a checklist and someone responsible for closing it out.
06
Sessions that expire
And at the first suspicion, sign out on all devices and change credentials from a clean computer.
Devices and habits: fewer doors, better guarded
07
Update and ask
Operating system, browser and website up to date. And one question for every vendor: how do you handle critical patches?
08
Lock down front desk email
It’s the inbox that gets the most attachments from strangers. It deserves extra layers: computers isolated from the rest of the network, firewalls and a separate zone (DMZ), so one click doesn’t go any further.
09
Webmail over desktop email clients
Services like Google Workspace automatically scan emails and attachments for malware before they reach the inbox. A layer that works on its own.
10
Keep extensions to a minimum
Only the essential, vetted ones. If it’s not used, uninstall it. And the front desk computer is for work only.
11
Be wary of urgency
An urgent complaint, an off-channel payment, a change of bank details. Verify through another channel before acting.
12
Have a plan for the bad day
Who decides, who gets called and in what order. Written down, within reach and rehearsed now and then, like a fire drill.
If it happens to you: what to do in the first hours
Nobody wants to put that plan to use. But if the moment comes, order matters.
Five steps, in this order
Step 1
Isolate
Disconnect the affected computer from the network to stop the spread.
Step 2
Take back control
Change passwords from a clean computer and end all open sessions.
Step 3
Alert your vendors
Technology, payments and sales channels. The sooner they know, the sooner they can review access and block suspicious activity.
Step 4
Talk to your guests
Through your official channel, with a clear message: what happened and what you will never ask them for.
Step 5
Document and report
Keep evidence and log what happened. If personal data is affected, regulations may require you to report it within a set deadline.
This is on all of us
Direct sales rest on a simple idea: guests trust your website enough to leave their details and their card there. Every scam that circulates under a hotel’s name, yours or someone else’s, chips away a little at that trust across the whole industry.
That’s why we believe cybersecurity can’t be a race to see who’s best protected. It’s a shared effort. Attackers trade tools, password lists and stolen access. The industry should be just as generous with what matters: sharing alerts, speaking up when a campaign is spotted and treating an attacked hotel as a victim, not as a fool.
Hoteliers, chains, technology vendors, distribution channels, associations. We all have something to contribute. And we all have something to lose if we don’t.
The bad guys work together. We should do it better.
Our part
We’re not going to tell you we’re invulnerable. Nobody is, and be wary of anyone who claims otherwise. What we can tell you is how we work to stay prepared.
Our technology is developed in-house and isn’t built on PHP, so PHP2Shell didn’t affect us directly. We’re not wearing that as a badge: the next vulnerability could show up anywhere else, which is why we never stop watching.
We also apply measures such as per-user two-factor authentication, full access traceability and alerts when a password shows up in a known public leak. We explain them in more detail in this article.
And if you have questions about the security of your direct channel, or something has landed in your inbox that doesn’t add up, get in touch. That’s what we’re here for.
Got something that doesn’t add up?
Tell us. Reviewing it together is the best way not to fall for it.
Talk to Paraty Tech
No one is immune. But no one has to face it alone.
Sources:
Barcelona Cybersecurity Congress 2026, session “From check-in to takeover” (Sascha Maier, SV Group) ·
Check Point Research (iTWire) ·
OpenSecurity ·
Brújula Digital ·
CriptoNoticias ·
Ding ·
NordVPN ·
Infobae ·
WebProNews ·
Escudo Digital
