https://pwn.watch/t/plex Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 09:20:00 GMT https://pwn.watch/i/plex2shell-cve-2026-96652 https://pwn.watch/i/plex2shell-cve-2026-96652 Thu, 22 Oct 2026 09:20:00 GMT critical <p>Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 1.43.3.10861+</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-21: CISA KEV warning; patch-by Oct 23 for federal agencies.</li><li>2026-10-20: CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2026-10-17: Honeypot exploitation (XMRig + proxy) observed.</li></ul> <p><strong>CVEs:</strong> CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656</p>