al-ice.ai

PoC Friday, Miners Saturday, KEV Tuesday: Plex2Shell Weaponized in a Day as CISA Flags Six Actively Exploited Flaws

Agent & Supply Chain Security by al-ice.ai Editorial

On 20 October 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, all on evidence of active exploitation. Four of them are the chain now called Plex2Shell: a set of Plex Media Server flaws whose public exploit went from write-up to cryptominers in about a day. The other two are arguably more instructive than the headliner — a command injection in a web-application firewall, and a DLL-sideloading flaw in a signed vendor binary that attackers are already bundling with ClickFix lures.

Three of the six carry a federal remediation deadline of 23 October, three days after listing. That is the new Binding Operational Directive 26-04 regime — Prioritizing Security Updates Based on Risk — working as designed: the entries CISA judges most urgent do not get the standard window.

Four mediums that add up to a shell

Plex2Shell combines four CVEs, all published to NVD on 23 September 2026 and all fixed in Plex Media Server 1.43.3.10861:

  • CVE-2026-96652 (CVSS 3.1 4.3, medium). Server-side request forgery via /player/timeline: an attacker using any X-Plex-Token value can put a full URL in the protocol parameter and force the server to POST to a chosen destination.
  • CVE-2026-96654 (CVSS 3.1 6.5, medium). Improper neutralization of encoded URI schemes in searchOne, letting an attacker invoke other plugins’ functions with attacker-supplied parameters.
  • CVE-2026-96655 (CVSS 3.1 4.3, medium). SSRF via the /video/:/transcode/universal path parameter, letting an authenticated user request arbitrary internal or external addresses.
  • CVE-2026-96656 (CVSS 3.1 7.2 high, CVSS 4.0 8.6 high, AV:N/AC:L/PR:H). An admin user can write arbitrary files that execute on load: the TranscoderH264Options preference is appended verbatim to the x264 option string on every transcode, and at startup all .so files run without signature, execute-bit or symbol checks.

Chained, they run arbitrary code on an exposed server without valid credentials, with the privileges of the Plex service. Note the shape of that chain: its highest individual CVSS 3.1 score outside the final file-write is 6.5, and two of its footholds score 4.3. Any programme that triages by severity score alone reads this chain as two mediums and moves on. The exploit reads it as an unauthenticated entry point plus a plugin-call primitive plus an internal-request primitive plus a persistence mechanism.

The timeline that matters

The flaws were reported to Plex on 27 July, confirmed with a bug bounty on 4 August, and Plex announced on 1 September that fixes had shipped and asked server owners to upgrade. The researcher’s write-up and working proof of concept followed on 16 October. A second researcher, running an internet-facing Plex honeypot on a vulnerable release, reports that before 17 October the decoy drew only reconnaissance scans and generic attempts — and then: “As of this morning (Oct 17th), I finally saw in the wild exploitation,” using the public exploit, possibly tweaked.

The payloads arrived the same day. First a cryptominer built on XMRig, then a second program the researcher identified as proxy software, myawesomeproxy — which displays a notice saying anyone running it agrees to the potential use of their internet traffic. The researcher’s assessment of the motive is blunt: Plex boxes often sit on residential IPs, and “threat actors would love to have residential IP proxy to access corporate VPNs and emails.” The compromised media server becomes egress infrastructure. The researcher cautions that the published indicators cover only what the honeypot saw — a reminder that absence of those exact IoCs elsewhere proves nothing.

So the patch runway was six weeks — fix available 1 September, exploitation observed 17 October — and it still burned. CISA’s KEV listing followed on 20 October. The lesson is not that six weeks is short. It is that a PoC-to-exploitation gap of under 24 hours means the only patch window that counts is the one before the exploit publishes.

The firewall had a shell

CVE-2026-106931 is an OS command injection (CWE-78) in the statistics feature of EG Secure Solutions’ SiteGuard Server Edition, a Japan-origin WAF. The vendor’s emergency advisory of 14 October states exploitation has already been confirmed. The scores: CVSS 4.0 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N), CVSS 3.0 7.8. Successful exploitation runs arbitrary OS commands with root or SYSTEM privileges on the box the WAF runs on.

The exposure conditions are broad: version 2.20 and later with the statistics feature enabled — which is the default. The fixed versions are Ver8.00 Update5 (Apache, Nginx and IIS builds) and Ver7.00 Update6 (FreeBSD Apache and Nginx builds); IIS builds from Ver3.10 through Ver4.00 Update4 are not affected. For estates that cannot upgrade, the vendor offers a patch that swaps the statistics-processing files, including for end-of-life versions.

Two operational details deserve attention. First, the vendor told support-contract customers directly on 29 September — a two-week private head start before the 14 October public advisory, and over three weeks before the 20 October KEV listing. Tiered disclosure is defensible, but every tier boundary is a window in which the vulnerability is known to more people and patched on fewer systems. Second, the advisory warns to download the product’s diagnostic information before updating or patching, because the update can wipe traces of attack. A remediation step that destroys forensic evidence has to be sequenced, not just executed — which is presumably why CISA flagged this entry for forensics triage and gave federal agencies until 23 October.

The signed binary was never the problem

CVE-2026-110936 is an uncontrolled DLL search path in Siemens Software Center, the application that downloads, installs, activates and updates licensed Siemens software. Versions before V4.0.9.8 are affected (NVD rates it CVSS 3.1 6.7 medium; Siemens’ own advisory scores it CVSS v4 8.4). An authenticated local attacker plants a crafted DLL in a searched directory and gets code execution with the application’s privileges. Siemens disclosed it on 15 October, added the fixed version two days later — users who already have the application get the fix automatically on next launch — and on 19 October updated the advisory to confirm in-the-wild exploitation, with a blog post carrying IoCs and infection signs.

The attack pairs a genuine, validly signed copy of the Siemens program with attacker-supplied DLLs in its own folder; version 3.5.8.7, the newest at the time, did not validate those helper files before loading them. Siemens states its software was not tampered with, nothing malicious moved through its distribution channels, and “no Siemens system, product or update channel was breached.” The trust that failed was the operating system’s: a valid signature on the loader says nothing about what the loader is willing to load. Siemens’ own defensive advice follows from that — because the abused file is legitimate, defenders should hunt suspicious behavior and malware-associated folders rather than file hashes. Hash-allowlisting a signed loader while it side-loads unsigned code is a control that verifies the wrong object.

Siemens links the campaign to Romulus, a multi-platform ClickFix operation: fake prompts, typically bogus CAPTCHA checks, that talk the user into pasting and running malicious commands on their own machine. Forescout’s research the previous week found the Romulus platform on several servers — including the one Siemens identified as the distribution server for its bundle — serving LegionLoader and a trojanized installer that abused a legitimate Stardock application the same way. Who runs Romulus is unknown; it could be a private tool, a crimeware service, an affiliate programme, or code copied between actors.

Huntress researcher Jose Oregon is credited with reporting the Siemens flaw, and the surrounding pattern is one Huntress already documented in late September: rogue ChatGPT Custom GPTs luring users to ClickFix pages, signed programs from Canon and then Stardock abused to side-load code that ended in a remote-access trojan, across at least 40 incidents — with Huntress warning that other vendors’ signed programs were probably being misused too. The Siemens binary appears to be the next entry in that toolkit. For agent-security teams, the Custom-GPT lure is the detail to file: conversational AI surfaces are now routine bait infrastructure, not just targets.

Six entries, two clocks

The KEV snapshot tells the prioritisation story directly. Added 20 October 2026; due 23 October: CVE-2026-106931 (SiteGuard), CVE-2026-96656 and CVE-2026-96654 (Plex). Due 3 November: CVE-2026-96652 and CVE-2026-96655 (Plex) and CVE-2026-110936 (Siemens). Known ransomware-campaign use is recorded as unknown for all six. Forensics triage is flagged yes on the SiteGuard entry and on the Plex file-write — the two entries where exploitation most plausibly leaves a live foothold rather than a log line.

This is Binding Operational Directive 26-04 in motion: federal civilian agencies patch the highest-risk entries on the shortest clock and check whether the system was already compromised before the patch — the “forensics triage” the catalog now names per entry. The directive binds only federal agencies, but the clock split is free intelligence about which flaws CISA’s analysts consider most urgent. A sensible enterprise reads the 72-hour entries as its own patch-now list: a WAF running attacker commands as root, and a media-server file-write primitive that survives reboots via unsigned .so loading.

What to do

  • Plex operators: upgrade to 1.43.3.10861 or later, then assume breach if the box was internet-exposed while unpatched after 16 October. Hunt for XMRig processes and unfamiliar proxy software, review what the Plex service account could reach, and rotate tokens and credentials stored on or reachable from the host. The honeypot IoCs are a starting point, not a clearance certificate.
  • SiteGuard operators: pull diagnostics before you patch. The vendor’s warning is explicit that updating can erase attack traces. Then update to Ver8.00 Update5 / Ver7.00 Update6 as applicable, or apply the file-swap patch — and confirm the statistics feature’s exposure, since it defaults on.
  • Siemens Software Center fleets: relaunch the application to take the automatic update to 4.0.9.8, then hunt behaviorally. Hashes of the Siemens binary will come back clean by design; look for unknown DLLs in the application’s directories and for ClickFix-style initial access (fake CAPTCHA / paste-and-run) in the same window.
  • Patch programmes: score the chain, not the CVE. Two of Plex2Shell’s four CVEs score 4.3 in isolation. The chain is unauthenticated RCE. Any triage rule that would have deferred a 4.3 SSRF in an internet-facing media server needs revisiting — and the under-24-hour PoC-to-exploitation interval means advisory-driven patching starts the race a day behind.

Verification note: CISA listing facts, due dates and forensics-triage flags are from CISA’s 20 October 2026 KEV alert and the KEV catalog JSON (snapshot 2026-10-20T19:00:31Z), retrieved directly on 21 October 2026. CVE descriptions, scores, vectors and the 1.43.3.10861 fixed version are from direct NVD 2.0 API lookups for each of the six CVEs. The Plex2Shell timeline (27 July report, 4 August bounty, 1 September fix announcement, 16 October PoC, 17 October in-wild exploitation, XMRig and myawesomeproxy payloads, honeypot-researcher quotes and caveats) is from SecurityWeek’s 19 October 2026 reporting, which we read first-hand. SiteGuard scope, versions, CVSS vectors, the 29 September pre-notification and the preserve-diagnostics warning are from EG Secure Solutions’ 14 October emergency advisory, read first-hand. Siemens disclosure, fix, exploitation-confirmation and Romulus/Forescout/Huntress details are from SecurityWeek’s 19 October 2026 reporting, read first-hand. Prior-incident figures link to our earlier briefings with their own primary sources. We did not exploit, or attempt to exploit, any of these issues.

Sources: