24h | 7d | 30d

CVE-2026-106931

Overview

  • EG Secure Solutions Inc.
  • SiteGuard Server Edition for Apache httpd
14 Oct 2026
Published
16 Oct 2026
Updated
CVSS v3.0
HIGH (7.8)
EPSS
0.66%
KEV

Description

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

Statistics

  • 7 Posts
  • 4 Interactions
Last activity: 2 hours ago

Fediverse

Profile picture fallback
@ssvc

SiteGuard exploited zero-day: CVE-2026-106931 (CVSS4: 8.5 high) SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

English translation:

A vulnerability (CVE-2026-106931) allowing OS command injection has been discovered in the statistics function of SiteGuard Server Edition. Exploitation has already been confirmed.

eg-secure.co.jp/siteguard/news

  • 1
  • 1
  • 0
  • 8h ago
Profile picture fallback
ekiledjian @edwardk

Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are exploiting an OS command-injection vulnerability in SiteGuard Server Edition, a widely used web application firewall, to execute commands with root or SYSTEM privileges, BleepingComputer reports. The critical flaw (CVE-2026-106931) affects the product’s statistics function, which is enabled by default; the vendor and Japan’s CERT confirm abuse in the wild, and patches are available. bleepingcomputer.com/news/secu

  • 1
  • 0
  • 0
  • 20h ago
Profile picture fallback
Patrick C Miller :donor: @patrickcmiller

Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited securityaffairs.com/201258/sec

  • 1
  • 0
  • 0
  • 8h ago
Profile picture fallback
Cybersecurity & cyberwarfare @cybersecurity
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM […]
Japan's SiteGuard WAF flaw CVE-2026-106931 is already being exploited
  • 0
  • 0
  • 0
  • 13h ago
Profile picture fallback
eSecurity Planet @esecurityplanet

CVE-2026-106931 SiteGuard WAF Flaw Exploited: Save Evidence Before Patching esecurityplanet.com/vulnerabil

  • 0
  • 0
  • 0
  • 6h ago
Profile picture fallback
Vito Botta @vitobotta

SiteGuard Server Edition, CVE-2026-106931: command injection in the statistics feature, commands as root. Actively exploited. The box in front of the internet, reachable from the internet, running as root. Patch it, then read your outbound logs.

  • 0
  • 0
  • 0
  • 6h ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 Exploitation active de CVE-2026-106931 dans le WAF SiteGuard Server Edition BleepingComputer, publié le 18 octobre 2026. L'article rapporte l'exploitation active d'une vulnérabilité critique dans SiteGuard Server Edition, un… 🟡 vérification factuelle moyenne #SiteGuard #WAF #Cyberveille
  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-99999

Overview

  • Linux
  • Linux
15 Oct 2026
Published
19 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.3)
EPSS
0.21%
KEV

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Statistics

  • 7 Posts
  • 6 Interactions
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Dataplane.org @dataplane

The Internet Last Week

* DNS root KSK rollover
icann.org/resources/pages/ksk-
ispcol.potaroo.net/2026-10/ksk
jpmens.net/2026/10/14/root-dns
bugs.launchpad.net/ubuntu/+sou
* IMC 2026
conferences.sigcomm.org/imc/20
* Linux KVM escape vulnerability
openwall.com/lists/oss-securit
cve.org/CVERecord?id=CVE-2026-
* Russian VKontakte drone attack effect
mastodon.social/@netblocks/117
* Ukraine Starlink/Starshield slowdown
reuters.com/world/europe/order
reuters.com/business/media-tel

#DNSSEC #IMC2026 #Linux #VKontakte #Starlink

  • 2
  • 3
  • 0
  • 14h ago
Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

PwnEscape (CVE-2026-99999) is a critical Linux kernel VM escape that let a guest run code as root on the host in lab tests. Update your kernel now.

securityonline.info/pwnescape-

  • 0
  • 0
  • 0
  • 19h ago
Profile picture fallback
Skid-T @skidt

CVE-2026-99999 🤣 Finally we reached 99999

Finalement, nous avons atteint 99999 🤣

  • 0
  • 0
  • 0
  • 11h ago
Profile picture fallback
Gauss :wlf: @Gauss

Great. Time to patch literally everything :wlfFlat:

git.kernel.org/pub/scm/linux/s

  • 0
  • 0
  • 0
  • 1h ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 CVE-2026-99999 : Évasion guest-to-host via une vulnérabilité dans la pile réseau Linux (KVM) Cet article détaille la découverte de CVE-2026-99999, une vulnérabilité critique dans la pile réseau du noyau Linux permettant une… 🟡 vérification factuelle moyenne #KVMEscape #LinuxKernel #Cyberveille
  • 0
  • 1
  • 0
  • 1h ago
Profile picture fallback
曖昧なイッヌ @aimainainnu.bsky.social
Linuxカーネルの深刻な脆弱性「PwnEscape」（CVE-2026-99999）、ゲストの仮想マシンからホスト側Linux OSに不正なコードを実行できる可能性 － Publickey www.publickey1.jp/blog/26/linu...
  • 0
  • 0
  • 0
  • 9h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] CVE-2026-99999 : Vulnérabilité critique PwnEscape sur Linux Une vulnérabilité critique du noyau Linux suivie sous le nom de CVE-2026-99999, surnommée PwnEscape, peut briser la frontière d’isolation entre les machines virtuelles et leurs hôtes sous-jacents. #Vulnérabilité #CVE #Cyberveille
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-102764

Overview

  • BeyondTrust
  • Remote Support
15 Oct 2026
Published
17 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
1.18%
KEV

Description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Statistics

  • 5 Posts
  • 5 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
CyberNetsecIO @netsecio

📰 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks

A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE

🔗 cyber.netsecops.io/articles/ch

  • 0
  • 0
  • 0
  • 4h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
Incident Radar | Attackers Actively Exploit BeyondTrust Remote Support Authentication Bypass CISA reports active exploitation of critical authentication bypass vulnerability CVE-2026-102764 in… Source: CISA Cybersecurity Advisories Full analysis: https://t.me/aiutocomputerhelp_lab/1288
  • 2
  • 1
  • 0
  • 16h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] CVE-2026-102764 : Zero-Day dans BeyondTrust exploité BeyondTrust a divulgué CVE-2026-102764, une vulnérabilité critique dans Remote Support (RS) qui a été exploitée comme une zero-day par un acteur de cyberespionnage soupçonné d’avoir des liens avec… #ZeroDay #Vulnérabilité #Cyberveille
  • 1
  • 0
  • 0
  • 6h ago
Profile picture fallback
Undercode Testing @undercode.bsky.social
Navigating the BeyondTrust Authentication Bypass (CVE-2026-102764): Threat Analysis, Exploitation Tactics, and Hardening Guide + Video Introduction: The discovery of CVE-2026-102764—a critical authentication bypass vulnerability in BeyondTrust Remote Support with a CVSSv4 score of 9.3—highlights…
  • 0
  • 0
  • 0
  • 4h ago
Profile picture fallback
キタきつね @kitafox.bsky.social
CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISAが既知の悪用された脆弱性2件をカタログに追加) #CISA (Oct 16) CVE-2025-61624 Fortinet複数製品におけるパス・トラバーサル脆弱性 CVE-2026-102764 BeyondTrustリモートサポート認証のなりすましによるバイパスの脆弱性 www.cisa.gov/news-events/...
  • 1
  • 0
  • 0
  • 18h ago

CVE-2026-88771

Overview

  • Citrix NetScaler
  • ADC
27 Sep 2026
Published
29 Sep 2026
Updated
CVSS v4.0
CRITICAL (9.5)
EPSS
1.08%
KEV

Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Statistics

  • 5 Posts
  • 12 Interactions
Last activity: 4 hours ago

Fediverse

Profile picture fallback
CrowdSec @CrowdSec

CrowdSec saw the first requests matching CVE-2026-88771 on September 22, five days before Citrix published it. It's a CVSS 9.5 flaw in NetScaler ADC and Gateway: no login, default configuration, root on the box.

Our signal counts are low, but don't read that as low risk. Careful operators pick their targets first, and two of the addresses we saw went after this CVE and nothing else.

Patching won't remove anyone already inside. The full story is in this week's Threat Alert 👉crowdsec.net/vulntracking-repo

  • 0
  • 1
  • 0
  • 7h ago
Profile picture fallback
@ssvc

For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:

rapid7.com/blog/post/ra-netsca

  • 1
  • 1
  • 0
  • 4h ago

Bluesky

Profile picture fallback
Cloudflare @cloudflare.social
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code. Here’s what you need to do now: https://blog.cloudflare.com/protect-your-netscaler-gateway/
  • 1
  • 8
  • 1
  • 7h ago
Profile picture fallback
CrowdSec @crowdsec.bsky.social
CrowdSec saw requests matching CVE-2026-88771 on Sep 22, five days before Citrix published it. CVSS 9.5 in NetScaler ADC and Gateway: no login, root on the box. Low signal counts, not low risk: two addresses went after this CVE alone. 👉 www.crowdsec.net/vulntracking...
  • 0
  • 0
  • 0
  • 7h ago

CVE-2026-110936

Overview

  • Siemens
  • Siemens Software Center
15 Oct 2026
Published
17 Oct 2026
Updated
CVSS v3.1
MEDIUM (6.7)
EPSS
0.14%
KEV

Description

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

Statistics

  • 4 Posts
  • 4 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
@ssvc

Active Exploitation of CVE-2026-110936 in Siemens Software Center

Siemens has validated that there is an active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center.

productcert.siemens.com/news/2

Attributed to Romulus multi-platform ClickFix campaign, this advisory contains IOC

  • 1
  • 1
  • 0
  • 2h ago
Profile picture fallback
@ssvc

"Threat actor? In my Siemens? It's more likely than you think"

Siemens has reported that CVE-2026-110936 is being exploited in the wild.

cyber.gc.ca/en/alerts-advisori

  • 1
  • 1
  • 0
  • Last hour

Bluesky

Profile picture fallback
Information Security Briefly @infosecbriefly.bsky.social
Threat actors exploited CVE-2026-110936 in Siemens Software Center by planting malicious DLLs to execute code with Software Center privileges.
  • 0
  • 0
  • 0
  • 2h ago
Profile picture fallback
Undercode Testing @undercode.bsky.social
Mitigating CVE-2026-110936 and Countering Romulus ClickFix DLL Side-Loading Campaigns Introduction: Adversaries are actively exploiting CVE-2026-110936, a high-severity DLL side-loading vulnerability within the Siemens Software Center, using sophisticated ClickFix social engineering lures. The…
  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-78162

Overview

  • Apache Software Foundation
  • Apache Camel
  • org.apache.camel:camel-hazelcast
19 Oct 2026
Published
19 Oct 2026
Updated
CVSS v4.0
CRITICAL (10.0)
EPSS
Pending
KEV

Description

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel. Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.

Statistics

  • 2 Posts
  • 2 Interactions
Last activity: 9 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-78162 (CRITICAL): Apache Camel's Hazelcast integration allows RCE via unsafe deserialization (4.0.0 – 4.18.5, 4.19.0 – 4.22.1). Upgrade to 4.23.0 or secure Hazelcast configs. Details: radar.offseq.com/threat/cve-20

  • 1
  • 0
  • 0
  • 9h ago

Bluesky

Profile picture fallback
Aiutocomputerhelp.it @aiuto-ch.bsky.social
CVE Radar | CVE-2026-78162 | CVSS 10.0 Apache Camel Hazelcast Deserialization RCE NVD describes a critical deserialization-of-untrusted-data vulnerability in Apache Camel’s camel-hazelcast component. Full analysis: https://t.me/aiutocomputerhelp_lab/1289
  • 1
  • 0
  • 0
  • 9h ago

CVE-2026-111862

Overview

  • RankMath
  • Rank Math SEO PRO
19 Oct 2026
Published
19 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.

Statistics

  • 2 Posts
  • 1 Interaction
Last activity: 1 hour ago

Fediverse

Profile picture fallback
Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Malicious Rank Math PRO update delivered a self-restoring WordPress backdoor

Copies of Rank Math PRO 3.0.123 downloaded or installed through updates between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware.
⠀
Activated copies could create persistent backdoors, administrator accounts, scheduled tasks and other malicious files. Credentials, database passwords and API keys accessible to compromised sites may also have been exposed.
⠀
Tracked as CVE-2026-111862, the incident carries a CVSS score of 9.8.

Rank Math released a clean version, 3.0.124, but updating alone does not remove backdoors already planted elsewhere. Affected websites should be treated as compromised and restored from a clean backup where possible.

The free Rank Math plugin available through WordPress.org was not affected.

  • 1
  • 0
  • 0
  • 1h ago
Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Official downloads and updates of Rank Math PRO served between October 15 and 16 contained malware.

Rank Math has removed the affected files and released clean version 3.0.124.

Wordfence assigned CVE-2026-111862 with a 9.8 severity rating.

Installing the update replaces the plugin, but does not remove backdoor files, unauthorized administrator accounts, or scheduled tasks placed elsewhere on the server.

Manual server cleanup or a…

en.hacks.gr/epivlavis-kodikas-

#RankMath #WordPress #Malware #CVE

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-93953

Overview

  • softaculous
  • Backuply – Backup, Restore, Migrate and Clone
16 Oct 2026
Published
16 Oct 2026
Updated
CVSS v3.1
HIGH (8.0)
EPSS
0.34%
KEV

Description

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.

Statistics

  • 2 Posts
Last activity: 5 hours ago

Bluesky

Profile picture fallback
セキュリティ対策Lab @securitylab-jp.bsky.social
WordPressプラグイン「Backuply」にSQLインジェクション脆弱性、管理者権限を奪取されるおそれ―CVE-2026-93953 rocket-boys.co.jp/security-mea... #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
  • 0
  • 0
  • 0
  • 22h ago
Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 [VULN] Restaurer une sauvegarde peut offrir votre site WordPress à un pirate à cause de cette faille CVE-2026-93953 Un simple utilisateur avec le rôle d'abonné glisse quelques lignes dans sa biographie, un administrateur restaure une sauvegarde WordPress quelqu… #Vulnérabilité #CVE #Cyberveille
  • 0
  • 0
  • 0
  • 5h ago

CVE-2026-21589

Overview

  • Atlassian
  • Bamboo Data Center
05 Oct 2026
Published
19 Oct 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
12.71%
KEV

Description

This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.

Statistics

  • 2 Posts
Last activity: 1 hour ago

Fediverse

Profile picture fallback
@ssvc

@todb ?? Rejected Reason: This CVE ID was unused by the CNA.

cve.org/CVERecord?id=CVE-2026-

  • 0
  • 0
  • 0
  • 8h ago
Profile picture fallback
Matthew Kienow @inokii

What's going on with CVE-2026-21589? It was added to CISA KEV on Oct. 15 and on Oct. 16 it was updated to rejected "false positive or a mistake".
* Oct. 16 cvelistV5 diff: github.com/CVEProject/cvelistV
* Atlassian advisory shows no changes from the Oct. 5 publication: confluence.atlassian.com/secur

  • 0
  • 0
  • 0
  • 1h ago

CVE-2026-96652

Overview

  • Plex
  • Media Server
23 Sep 2026
Published
23 Sep 2026
Updated
CVSS v3.1
MEDIUM (4.3)
EPSS
0.22%
KEV

Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Statistics

  • 3 Posts
  • 59 Interactions
Last activity: Last hour

Fediverse

Profile picture fallback
@ssvc

Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: boredhackerblog.info/2026/10/p

  • 36
  • 20
  • 0
  • 7h ago
Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Plex Media Server vulnerabilities are exploited in the wild after the Plex2Shell PoC went public. Attackers drop miners. Update to 1.43.3.10861.

securityonline.info/plex2shell

  • 1
  • 2
  • 0
  • 20h ago
Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Threat actors are actively exploiting the Plex2Shell vulnerability chain—consisting of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656—in Plex Media Server.

Exploitation began a day after a proof-of-concept went public on October 16, 2026, allowing unauthenticated remote code execution.

Attacks have deployed the mylovelyminer cryptocurrency miner and the myawesomeproxy Linux backdoor.

Plex patched these flaws in version…

en.hacks.gr/epitheseis-se-syst

#Plex #Malware #CVE #Linux

  • 0
  • 0
  • 0
  • Last hour
Showing 1 to 10 of 63 CVEs