CISA Says Plex Media Server Flaws Are Under Attack, Orders Agencies to Patch

If you run Plex Media Server at home and can reach it from outside your house, Plex’s advice is blunt: if the software is older than version 1.43.3.10861, assume the box may already be compromised.

The US Cybersecurity and Infrastructure Security Agency (CISA) added six flaws to its Known Exploited Vulnerabilities catalogue on 20 October. Four of them are in Plex Media Server, one is in EG Secure Solutions’ SiteGuard Server Edition, and one is in Siemens Software Center. A KEV listing is CISA’s way of saying it has evidence of attacks in the wild. Under Binding Operational Directive 26-04, US federal civilian agencies then have to fix the flaws. According to The Hacker News, three of them must be fixed by 23 October and the rest by 3 November. The story is tracked on our Ransomware & Cyber Attacks hub.

A public exploit turned a summer patch into a crypto-mining spree

The four Plex bugs, which researchers have nicknamed Plex2Shell, are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex’s security notice describes them in turn:

• an unauthenticated server-side request forgery in the player timeline endpoint;
• access to internal agent functions over the loopback interface;
• disclosure of the server owner’s admin token;
• an arbitrary file write into the Codecs directory through transcoder preferences.

Chained together, they let an attacker run code on the server.

The fix has been out since the summer. What changed was that “a public proof of concept was released on October 16,” Plex said in an update posted at 21:17 BST on 19 October. The company said the flaws “are being actively and widely exploited”, and that compromised servers were running cryptocurrency miners and proxy software.

Censys said its honeypots first saw exploitation on 17 October. It counted about 324,000 internet-facing Plex hosts, around 44% of them in the US, and estimated that roughly 30% run a vulnerable build. Nearly 8,000 of those are on 1.43.3.10828, an early 1.43.3 build that Censys says is still exploitable. Fewer than 2% of vulnerable hosts had upgraded in the three days after the chain went public. Censys pointed to updates as the likely reason: Windows and macOS installations update themselves, but Linux, NAS and Docker set-ups need updating by hand.

The researcher who found the chain is named as Zach Main by The Hacker News and goes by code-zm on GitHub. He told Ars Technica that he leaned heavily on AI tools. “This was not a matter of telling the LLM ‘go hack Plex,'” he said.

Plex lists several signs of compromise:

• processes or files named myawesomeproxy, mylovelyminer or x12345;
• connections to proxystream.st;
• unfamiliar .so or .dll files in the Codecs folder.

For an affected server, Plex recommends rebuilding it from a clean state, signing out of all devices, changing the account password, and turning off remote access rather than forwarding port 32400.

The SiteGuard and Siemens flaws were already being exploited

CVE-2026-106931 is an OS command injection flaw in SiteGuard Server Edition, a web application firewall widely used in Japan. EG Secure Solutions’ alert says the bug sits in a statistics function that is switched on by default and allows commands to run as root or SYSTEM. It affects Ver2.20 and later. Fixes are in Ver8.00 Update5 for Apache, Nginx and IIS, and in Ver7.00 Update6 for FreeBSD, and patches are offered for unsupported versions too. The company tells customers to download diagnostic information before updating, because the update may erase traces of an intrusion. It rates the flaw 8.5 under CVSS 4.0.

CVE-2026-110936 is an uncontrolled search path flaw in Siemens Software Center, which we reported on earlier. Siemens ProductCERT says that attackers in the “Romulus” ClickFix campaign abused version 3.5.8.7 to sideload malicious DLLs. Version 4.0.9.8 fixes the flaw and installs automatically the next time the software starts. “No Siemens system, product or update channel was breached to our knowledge,” the company said.

Federal agencies have until Friday on the first three. Home users have no deadline, and Censys’s figures suggest the people least likely to have patched are those running Plex on a NAS or in a container, where nothing updates unless they do it themselves.

Sources

• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog
• The Hacker News: CISA orders federal agencies to patch
• Plex Forum: Important security update for Plex Media Server v1.43.2 and earlier
• Censys advisory
• Ars Technica: Recently fixed Plex Media vulnerabilities are being exploited to install malware
• Siemens ProductCERT: Active exploitation of CVE-2026-110936
• EG Secure Solutions: SiteGuard alert

Related stories

• Attackers Are Abusing a Siemens Software Center Flaw to Infect Windows PCs