Cybersecurity
CISA warns of Plex2Shell exploitation
CISA said attackers were exploiting four Plex Media Server vulnerabilities that could lead to admin-token theft and code execution, while also adding separate flaws in Siemens Software Center and SiteGuard Server Edition to its exploited list.
- CISA said attackers were actively exploiting four vulnerabilities in Plex Media Server that were collectively called Plex2Shell.
- The chained flaws could let an attacker obtain the owner’s admin token and run code with elevated privileges.
- CISA told federal agencies to prioritise patching affected systems or apply mitigations by 23 October.
- Zach Main said he reported the Plex flaws to Plex on 27 July, published technical details on 16 October and a proof of concept three days later.
- Reports of exploitation in the wild began on 17 October, and early activity reportedly targeted Plex honeypots to deploy a cryptominer.
CISA said four Plex Media Server flaws were being actively exploited under the Plex2Shell name. It said chaining them could let an attacker take the owner’s admin token and execute code with elevated privileges, and it told federal agencies to patch affected systems or use mitigations by 23 October.
The article said security researcher Zach Main discovered the issues and reported them to Plex on 27 July. It also said he published technical details on 16 October and a proof-of-concept exploit three days later.
The piece said the flaws affected Plex Media Server versions before 1.43.3.10861, which was released on 4 August. It said reports of exploitation in the wild started on 17 October and initially focused on Plex honeypots, where attackers tried to install a cryptominer.
CISA also added CVE-2026-110936 in Siemens Software Center to its Known Exploited Vulnerabilities list. Siemens said on 19 October that hackers were using the flaw in campaigns tied to Romulus, and Forescout said Romulus might be a private panel, a commercial delivery service, an affiliate framework or copied software.
The agency also added CVE-2026-106931 in SiteGuard Server Edition to the same catalogue. The vendor and Japan’s CERT said the flaw was being actively exploited late last week and advised upgrades to the listed versions.
Named in this story
People
- Zach Main
- discovered the Plex flaws and later published technical details and a proof of concept
Companies
- Plex
- received the responsible disclosure from the researcher
- Siemens
- warned that hackers were using the Siemens Software Center flaw in campaigns linked to Romulus
- Forescout
- commented on how Romulus might be operated and distributed
Organisations
- Japan's CERT
- flagged the SiteGuard Server Edition flaw as actively exploited
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- warned that attackers were exploiting the Plex flaws and set a patching deadline for federal agencies
Products and systems
- Plex Media Server
- the software affected by the four vulnerabilities
- Plex2Shell
- the name given to the four chained Plex vulnerabilities
- Siemens Software Center
- contained the search path flaw added to CISA’s exploited-vulnerabilities catalogue
- Romulus
- the delivery platform linked to the Siemens Software Center attacks
- SiteGuard Server Edition
- the web application firewall affected by an actively exploited command-injection flaw
How the source tells it
Mostly plain security reporting, with urgency from active-exploitation warnings and patch deadlines, plus a promotional coda for a vendor report.
- urgency deadline-driven patching advice is paired with active-exploitation warnings
- threat framing the flaws are described as a chain that can yield admin access and code execution
- vendor boosterism the closing section shifts into a report pitch with performance claims and a call to action