Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
78
Product
Plex Media Server
- Mentions · 7d1
- Mentions · 30d14
- All mentions16
- First seenSep 4, 2026
- Last mentioned4d ago
Timeline
16 articles · newest firstPHP, Node.js, LiteLLM and an Indian CA hit in one day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
78
CISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
80
CISA Orders Patch for Exploited Plex2Shell, Siemens and SiteGuard Flaws
CISA added four Plex2Shell vulnerabilities and two other exploited flaws to its KEV catalog, ordering federal agencies to patch them by October 23 and November 3, 2026.
75
CISA adds six exploited vulnerabilities to the KEV catalog
The entries cover four Plex Media Server bugs, SiteGuard command injection, and a Siemens path flaw.
76
CISA adds Plex arbitrary file-write flaw to KEV (CVE-2026-96656)
An admin can write files that load as unsigned .so modules on Plex before 1.43.3.10861; due date is October 23.
74
CISA lists Plex plugin-call flaw in KEV (CVE-2026-96654)
Plex Media Server before 1.43.3.10861 can let an attacker invoke other plugins’ functions; agencies have until October 23.
74
CISA lists exploited Plex Media Server SSRF (CVE-2026-96655)
Authenticated users on builds before 1.43.3.10861 can request arbitrary addresses; the KEV due date is November 3.
60
CISA adds Plex Media Server SSRF to KEV (CVE-2026-96652)
Any X-Plex-Token can force a POST via /player/timeline on builds before 1.43.3.10861; the due date is November 3.
76
Attackers use Plex2Shell to mine crypto on vulnerable Plex servers
A public proof of concept for four Plex flaws was used within a day to drop XMRig and proxy software on a honeypot.
74
Attackers exploit Plex2Shell flaws to install miners and a proxy
Four chained bugs give unauthenticated remote code execution; Plex fixed them in 1.43.3.10861 on August 3.
78
Plex Media Server flaws exploited in the wild to drop a miner
A honeypot saw RCE attempts from three IPs, then a miner and a proxy called myawesomeproxy.
76
Plex2Shell chain used against Plex servers a day after disclosure
A honeypot saw the public exploit drop an XMRig miner and later proxy software called myawesomeproxy.
76
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
72
Over 36,000 exposed Plex servers vulnerable to recent flaws
Over 36,000 internet-exposed Plex Media Server instances remain unpatched against recently disclosed vulnerabilities, leaving them open to attack.
48
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.
45
Related CVEs
by mentions- CVE-2026-966562%8.6Admin-Triggered Arbitrary File Write & RCE in Plex Media Server
- CVE-2026-966542%6.9Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-966522%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-966552%5.3Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-1069313%8.5OS command injection in SiteGuard Server Edition
- CVE-2026-110936<1%8.4DLL Search-Path Hijacking in Siemens Software Center
- CVE-2026-9722918%10.0Unauthenticated RCE in GitLab CE/EE via CI/CD regex
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2020-574173%7.2Authenticated Deserialization RCE in Plex Media Server on Windows
- CVE-2025-34158<1%8.5Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the…
Appears with
- Plexvendor · 16
- CISAorganization · 7
- xmrigmalware · 5
- myawesomeproxymalware · 4
- Siemens Software Centerproduct · 3
- Siemensvendor · 3
- EG Secure Solutionsvendor · 2
- PHPproduct · 2
- SiteGuard Server Editionproduct · 2
- Plexorganization · 2
- Remote Supportproduct · 1
- LastPassvictim · 1
- boredhackerblogorganization · 1
- eMudhravendor · 1
- BeyondTrustvendor · 1
- Plex Desktopproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.