Peacey Hospitality Report: October 10, 2026 | Hotel Wi-Fi Security, Construction Pipeline and ANTlabs Updates

By Richard Peacey, Peacey Systems | October 10, 2026

Peacey Systems has been the North American ANTlabs distributor since the mid-2000s, delivering premium 24/7/365 Tier 1 support and network operations center (NOC) services for hotel networks.

Executive Summary

For general managers and owners: attackers took over a widely used brand of internet router in September 2026 before a fix existed, and more than 122,500 of those devices were exposed (Help Net Security, citing Shadowserver). Hotel Wi-Fi security is a business issue: the average hospitality data breach now costs USD 4.33 million (2026 Cost of a Data Breach Report), and card security rules require critical patches within one month (PCI DSS v4.0.1). Ask your IT team this week: Are routers and gateways patched? Is remote management closed to the internet? Are guest, payment and back-office networks separated? Elsewhere, U.S. conversions hit a record and ANTlabs shipped new hardware and patches.

Key Takeaways

• Patch MikroTik RouterOS to 7.24.3, 7.23.6, 6.49.21 or later, and remove SSH, WebFig, Winbox and API access from the WAN (MikroTik).
• Know the stakes: hospitality breaches averaged USD 4.33 million in 2026, up from USD 4.03 million in 2025 (Cost of a Data Breach Report 2026).
• Plan for conversions: the U.S. conversion pipeline reached a record 1,567 projects (Lodging Econometrics).
• Update ANTlabs gateways: current releases are SG5 Update #17, ASP 2.9.1 and ANTlabsEzCast Update 5 (ANTlabs).

Security Breaches

MikroTik RouterOS SSH Exploit (September 2026): What Happened

CERT Polska, Poland’s national CSIRT, identified six RouterOS vulnerabilities; two chain into unauthenticated administrator access over SSH, dubbed “MikroTrick” (CERT Polska technical analysis):

• CVE-2026-67279: a client-requested rekey lets an unauthenticated session skip to channel handling.
• CVE-2026-86060: a crafted username such as “-2” grants full administrator rights.

Attacks date from at least September 2, 2026; MikroTik published fixed releases on September 3 (MikroTik security advisory). Attackers created a full-privilege user named “ops” and exfiltrated diagnostic files (CERT Polska).

Scale by the Numbers

• 122,500+ exposed devices: the Shadowserver Foundation counted at least 122,500 MikroTik devices with SSH reachable from the internet in one 24-hour scan on September 5, 2026. That measures exposure, not compromise; no public compromise count exists (Help Net Security, quoting Shadowserver).
• Three CVEs on CISA’s Known Exploited Vulnerabilities catalog: CVE-2026-86060 and CVE-2026-67277 were added on September 10, 2026, and CVE-2026-67279 on September 25, 2026 (CISA KEV).

Affected Versions and Fixed Releases

• Fixed releases: the exploited chain requires reachable SSH, which MikroTik’s default configuration blocks from the internet. All six CVEs are fixed in 7.24.3 (stable), 7.23.6 (long-term) and 6.49.21 or later. The certificate fix in 7.24.2 and 7.23.4 was incomplete, so routers upgraded in early September need a second upgrade (MikroTik).
• Related flaw: CVE-2026-84411 (CVSS 9.8), a pre-authentication web management flaw before 7.24, had no known exploitation as of September 29, 2026 (CISA ICSA-26-272-06).

Remediation Checklist for Routers and Hotel Internet Gateways

• Patch, then check for compromise: run /system/device-mode/print and look for “flagged”. Search logs for “login failure for user -2” and “added by ssh:-2@”, and look for an “ops” account. The absence of the flag does not prove the device is clean (CERT Polska advisory).
• Hunt and recover: review users, SSH keys, scripts, scheduler, proxy settings and tunnels. If compromised, isolate, preserve logs, factory-reset, rebuild and rotate all secrets; never restore the old backup.
• Close management on the WAN: allow SSH, WebFig, Winbox and API only from a dedicated management subnet or a modern VPN (MikroTik hardening guide).
• Harden and monitor: disable the default “admin” user, use 12+ character unique passwords, disable unused services, alert on new admin accounts, and replace hardware that cannot run a fixed release.

Why It Matters for Hotels: PCI DSS 4.0, Brand Standards and Breach Costs

PCI DSS v4.0.1 and Guest Wi-Fi

PCI DSS v4.0.1 is the only active version of the standard (PCI SSC), and its 51 future-dated requirements became mandatory on March 31, 2025 (PCI SSC). Four map directly to the hotel internet gateway (PCI DSS v4.0.1):

• Requirement 6.3.3: install critical security patches within one month of release.
• Requirement 1.3.3: controls between all wireless networks and the cardholder data environment, denying by default.
• Requirement 2.3.1: change wireless vendor defaults, including keys, passwords and SNMP.
• Requirement 11.2.1: test for unauthorized wireless access points at least quarterly.

Brand Guest Wi-Fi Standards

Franchised hotels must also meet brand HSIA standards for guest Wi-Fi performance, segmentation and support. An unpatched, internet-managed gateway risks falling short of both PCI DSS and the brand; confirm current requirements before any refresh or reflag.

What a Breach Costs a Hotel

• USD 4.33 million: the average hospitality-industry breach cost in 2026, up from USD 4.03 million in 2025 (Cost of a Data Breach Report 2026).
• USD 4.99 million: the global cross-industry average, a record (same report).

Guest Wi-Fi Design: VLAN Segmentation, Captive Portal and Bandwidth Management

• VLAN segmentation: isolate guest, conference, casting, IPTV, PMS, payment and back-office networks from each other and from management.
• Captive portal and PMS integration: authenticate guests against the property management system (PMS) and keep the portal reachable under load; SG5 Update #17 added a dedicated QoS tier for this (ANTlabs release notes).
• Bandwidth management: per-plan and per-device limits keep heavy streamers from degrading HSIA, especially as Wi-Fi 6, 6E and 7 push throughput toward gateway limits.
• MDU and extended stay: multi-dwelling unit (MDU) Wi-Fi needs persistent onboarding and casting that copes with randomized device identifiers.

Hotel Construction Pipeline 2026: What New Builds Mean for Hospitality Wi-Fi

United States

• Total pipeline: 5,975 projects and 703,001 rooms at the end of Q2 2026, down about 4.9% in projects and 4.6% in rooms year over year (Lodging Econometrics; Construction Dive).
• Under construction: 1,081 projects and 133,216 rooms. CoStar’s March 2026 data showed U.S. rooms under construction down year over year for a 15th consecutive month (CoStar).
• Momentum and conversions: Q2 project announcements rose 18% and starts 14% year over year, and conversions hit a record 1,567 projects and 152,044 rooms (Lodging Econometrics).
• Chain scales: upper midscale (2,225 projects) and upscale (1,282 projects) account for 59% of pipeline projects, and luxury reached a record 103 projects (same source).
• Supply: CoStar forecasts 2026 supply growth of 0.4%, with midscale-tier development weighted toward extended stay (CoStar Q3 2026 forecast).

Canada

• Record pipeline: 345 projects and 47,874 rooms (up 4% and 7% year over year), 64 projects under construction, a record 140 upper midscale projects, and 55% of projects in Ontario (Lodging Econometrics Canada).

What it means for hotel networks: conversions often inherit legacy networks on tight reflag timelines; every new or reflagged property needs a patched, monitored gateway from opening day.

Hotel Technology Trends: Guest Wi-Fi Demand, IT Budgets and AI

• Guest demand: 86% of 1,519 U.S. guests surveyed in May 2026 rate high-speed Wi-Fi essential (2026 Consumer Hotel Habits Report).
• Budgets: 88% of hotels plan to increase 2026 technology budgets; technology averages 4.25% of revenue, about 60% of it on maintenance (2026 Lodging Technology Study).
• Priorities and gaps: 83% rank data security a top initiative and 59% bandwidth, while 47% lack skilled in-house expertise (same study).
• AI adoption: 98% of owners use AI, 32% have embedded it across most operations, and 57% require a human in the loop (2026 Owner Trends Report coverage).

AI for Tier 1 Hotel Wi-Fi Support: Assist, Don’t Replace

Let AI handle ticket intake, alarm correlation and early warnings such as expiring certificates; keep people on gateway changes, escalations and guest conversations.

ANTlabs News, Product Updates and Patches

Product News and Launches

• SG Pro 5410 (available from May 1, 2026): the new flagship, with 10GBase-T ports, up to 1.5x the SG Pro 5400’s performance and up to 30,000 concurrent users on one server (ANTlabs press release).
• Recent launches: ANTlabsEzTV, an IPTV and in-room engagement platform (November 11, 2025), and the entry-level SG Express 5000 gateway with 40+ PMS integrations and zero-touch provisioning (October 13, 2025) (ANTlabs press releases).

End-of-Life Notice: SG Pro 5400

End of life took effect April 15, 2026, with the SG Pro 5410 as replacement; software support ends April 15, 2029, and technical support April 15, 2031 (ANTlabs EOL notice).

Top Three Patches

1. SG5 Update #17 (July 2, 2026): seven kernel and web-server CVE fixes, a QoS tier for unauthenticated users, and an auto-login fix for MAC-blocked devices. HA peers must be at update level 16 to 18; reboot afterward.
2. ASP 2.0 Update #9 (June 10, 2026; ASP 2.9.0/2.9.1): VLAN, plan, location and site APIs, cast-server terminal access, and server-side session termination.
3. ANTlabsEzCast Update 5 (September 11, 2026): security hardening, custom domain support and a compatibility fix (ANTlabs Hospitality release notes).

Note that the SG5 Update #15 default SSL certificate expires February 8, 2027. Full ANTlabs release notes.

ANTlabs at HITEC 2026

At HITEC San Antonio (June 15–18, 2026), ANTlabs showcased SG5, ASP Cloud, ANTlabsEzTV, ANTlabsEzProfile (Hotspot 2.0) and an AI-powered Wi-Fi concierge (ANTlabs events; ANTlabs HITEC post).

Hospitality Technology and Investment Events

Upcoming

• PCI SSC Europe Community Meeting: October 20–22, 2026, Edinburgh (PCI SSC).
• EquipHotel Paris and HITEC Paris: EquipHotel runs November 2–5, 2026, and the inaugural HITEC Paris conference is November 5, 2026 (HFTP).
• HITEC Tokyo: December 2–4, 2026 (HITEC).
• ALIS (Americas Lodging Investment Summit): January 25–27, 2027, Los Angeles (ALIS).
• NYU International Hospitality Investment Forum: June 6–8, 2027, New York City (NYU IHIF).
• HITEC Orlando 2027: June 28–July 1, 2027, Orange County Convention Center (HITEC; Hotel Dive 2027 calendar).

Recently Held

• HFTP Annual Convention: September 22–24, 2026, Reno; next is October 19–21, 2027, Orlando (HFTP via Hotel Online).
• HTNG Connect: EMEA: September 28–30, 2026, Edinburgh; AHLA’s HTNG page lists May 6–7, 2027, Washington, DC, next (AHLA; HTNG events).

Why Managed Wi-Fi for Hotels Needs a Monitored Gateway and a 24/7 NOC

The MikroTik exploit preceded its patch. With untrusted guest devices one hop from the gateway, hotel Wi-Fi security on any platform depends on current firmware, closed management, segmentation and 24/7 monitoring.

What to Watch Next Issue (November 1, 2026)

• Q3 2026 pipeline data: Lodging Econometrics published its Q3 2025 U.S. pipeline report on October 27, 2025, so Q3 2026 figures are expected in late October (Lodging Econometrics).
• PCI SSC Europe Community Meeting (October 20–22): takeaways on AI and payment security.
• EquipHotel and HITEC Paris (November 2–5): a preview of the cybersecurity and AI program.
• MikroTik follow-ups: further revisions to MikroTik’s advisory (last updated October 6, 2026) and any new CISA KEV entries.
• ANTlabs releases: any new SG5, ASP or ANTlabsEzCast updates posted to the ANTlabs release notes.

FAQ: Hotel Wi-Fi Security and Gateways

What Is HSIA in a Hotel?

HSIA (high-speed internet access) is the guest internet service; the gateway behind it handles the captive portal, PMS integration, plans and bandwidth management.

Which MikroTik RouterOS Versions Fix the SSH Exploit?

According to MikroTik’s September 2026 advisory, RouterOS 7.24.3, 7.23.6, 6.49.21 and any later release fix all six CVEs.

Does PCI DSS Apply to Hotel Guest Wi-Fi?

Segmentation normally keeps guest Wi-Fi out of scope, but PCI DSS v4.0.1 still requires controls between all wireless networks and cardholder data, plus quarterly wireless testing. Your assessor confirms scope.

How Should Hotels Segment Guest Wi-Fi?

Put guest, casting and IPTV, conference, PMS, payment and management traffic on separate VLANs with firewall rules between them, and never expose management to guests or the WAN.

Is the ANTlabs SG Pro 5400 Still Supported?

Yes. ANTlabs provides software support until April 15, 2029, and technical support until April 15, 2031. The SG Pro 5410 is the replacement for new deployments.

How Peacey Systems Can Help

We provide complete IT managed staffing services, including all AI and cloud infrastructure, through onshore and offshore teams in the following roles:

• Help desk, technical support (Tier 1 through Tier 4) and 24/7 NOC monitoring
• Network, infrastructure and unified communications engineering
• Cloud, AI, analytics and reporting
• AI-powered contact center and support operations
• Field services, installation and dispatch
• Project, quality and account management

See the full role list and our AI contact center capabilities on IT Managed Staffing, AI and Cloud Services. For ANTlabs environments, we audit gateway exposure, roll out SG5 Update #17, plan SG Pro 5400-to-5410 refreshes, and support new builds and conversions from opening day. Contact Peacey Systems.

Sources & Credits

• SÅ‚awomir Rozbicki, CERT Polska: MikroTrick: technical analysis, disclosure process, and the use of LLM agents, CERT Polska, September 22, 2026.
• CERT Polska (vulnerabilities discovered by SÅ‚awomir Rozbicki): Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended, CERT Polska, September 5, 2026.
• MikroTik: September 2026 vulnerability, MikroTik Security, September 3, 2026 (updated October 6, 2026).
• Normunds R.: Securing your router, MikroTik Documentation, last updated January 6, 2025.
• The Shadowserver Foundation: MikroTik SSH identification added to daily scans (scan data for September 5, 2026), LinkedIn, September 6, 2026.
• Sinisa Markovic: Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication, Help Net Security, September 7, 2026.
• CISA: Known Exploited Vulnerabilities Catalog, Cybersecurity and Infrastructure Security Agency, entries dated September 10 and September 25, 2026.
• CISA: MikroTik RouterOS (ICSA-26-272-06), Cybersecurity and Infrastructure Security Agency, September 29, 2026.
• PCI Security Standards Council: PCI DSS v4.0.1: Requirements and Testing Procedures (Requirements 1.3.3, 1.4.1, 2.3.1, 6.3.3 and 11.2.1), PCI SSC Document Library, June 2024.
• PCI Security Standards Council: Just Published: PCI DSS v4.0.1, PCI Perspectives blog, June 2024.
• Alicia Malone and Lauren Holloway, PCI Security Standards Council: Coffee with the Council Podcast: Guidance for PCI DSS E-commerce Requirements Effective After 31 March 2025, PCI Perspectives blog.
• IBM and Ponemon Institute: Cost of a Data Breach Report 2026 (PDF), 2026.
• Lodging Econometrics: LE Debuts 2028 U.S. Hotel Openings Forecast, Projects 832 New Hotels to Open, Lodging Econometrics, July 23, 2026.
• Lodging Econometrics: In Canada, Lodging Econometrics Reports Record-High Total Construction Pipeline Projects, at Q2 2026, Lodging Econometrics, July 28, 2026.
• Lodging Econometrics: U.S. Hotel Construction Pipeline Remains Steady Year-Over-Year, with Extended-Stay Hotels Comprising 40% of Total Projects at the Q3 2025 Close, Lodging Econometrics, October 27, 2025.
• Jenna Graber: US hotel construction pipeline down in Q2, but higher-tier segments saw growth, Construction Dive, July 28, 2026.
• CoStar: U.S. hotel construction down for 15 consecutive months, CoStar, April 29, 2026.
• CoStar: U.S. Hotel Forecast Assumptions – Q3 2026, CoStar, August 6, 2026.
• Questex: New Consumer Research Released Ahead of The Hospitality Show Reveals Hotels Are Leaving Loyalty Revenue on the Table, Questex, August 10, 2026.
• Mehmet Erdem, Ph.D., and Robert Firpo-Cappiello: 2026 Lodging Technology Study: Integrating AI, Hospitality Technology, 2026 edition.
• Lea Mira: Research: 98% of Hotels Have Begun Using AI, But Only 32% Say It’s Embedded Across Most of Their Operations, Hotel Technology News, January 29, 2026.
• ANTlabs: Introducing SG Pro 5410 as the New Flagship SG Pro Model, ANTlabs, 2026.
• ANTlabs Product Department: SG Pro 5400 EOL Announcement, ANTlabs, April 7, 2026.
• ANTlabs: Press Release Archives (ANTlabsEzTV launch, November 11, 2025; SG Express 5000 launch, October 13, 2025), ANTlabs.
• ANTlabs: Release Notes Archives (SG5 Updates #15–#17, ASP 2.8.0, ASP 2.9.0 and 2.9.1), ANTlabs, January–July 2026.
• ANTlabs: ANTlabs EzCast Release Notes, ANTlabs Hospitality, September 11, 2026.
• ANTlabs: Events and HITEC 2026 post, ANTlabs and LinkedIn, June 2026.
• PCI Security Standards Council: PCI SSC Europe Community Meeting Marks 20th Anniversary, Returns to Edinburgh, PCI SSC, July 28, 2026.
• HFTP: HFTP and RX Reveals Launch of HITEC Paris, Co-Located With EquipHotel Paris, HFTP, May 26, 2026.
• HFTP: HITEC Upcoming Conferences, HITEC, accessed October 10, 2026.
• HFTP (contact: Eliza Selig): HFTP’s 2026 Annual Convention Unites 300+ Hospitality Professionals for Education, Connection and Celebration, Hotel Online, September 25, 2026.
• Northstar Meetings Group: ALIS Host Hotel, ALIS, accessed October 10, 2026.
• Questex: NYU International Hospitality Investment Forum, IHIF, accessed October 10, 2026.
• Jenna Graber: The top hospitality conferences in 2027, Hotel Dive, October 6, 2026.
• American Hotel & Lodging Association: 2026 HTNG Connect: EMEA and HTNG Events, AHLA, accessed October 10, 2026.

AI disclosure: This report was researched and drafted with the help of AI tools and reviewed by Peacey Systems. Every statistic links to its original source above. Charts were produced by Peacey Systems from the cited sources.