CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

CISA has issued an alert about active exploitation of a vulnerability chain nicknamed Plex2Shell, which targets Plex Media Server installations. By combining four separate bugs — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — attackers can steal a server owner's admin token and achieve remote code execution with elevated privileges; researcher Zach Main rates the combined chain 9.8 on the CVSS scale even though the individual flaws are only medium to high severity. The issues affect all Plex Media Server builds prior to version 1.43.3.10861 (released August 4), and exploitation attempts began surfacing on October 17, initially deploying cryptomining malware against exposed honeypots; federal agencies have been told to patch or mitigate by October 23. Separately, CISA also added to its Known Exploited Vulnerabilities list a path-handling flaw in Siemens Software Center (CVE-2026-110936), tied to a malware delivery platform called Romulus, and a command-injection bug in Hitachi Solutions' SiteGuard Server Edition WAF (CVE-2026-106931), urging affected organizations to update to the vendors' patched releases.