CISA adds four chained Plex Media Server flaws to KEV catalog

🚨 ACTIVE EXPLOITATION

• CISA adds four chained Plex Media Server vulnerabilities, including SSRF flaws, to KEV catalog CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
  CISA has added four exploitable Plex Media Server vulnerabilities that can be chained together to its Known Exploited Vulnerabilities catalog.

  • Applies to organizations running self-hosted or NAS-based Plex Media Server, especially deployments exposing the web interface to untrusted clients; affected versions are prior to 1.43.3.10861.
  • CVE-2026-96652 and CVE-2026-96655 are SSRF flaws: one lets any X-Plex-Token value force the server to POST to attacker-chosen destinations via the /player/timeline protocol parameter, the other lets authenticated users request arbitrary internal or external addresses via the '/video/:/transcode/universal' path.
  • CVE-2026-96654 allows improper neutralization of encoded URI schemes so attackers can call other plugins' functions with their own parameters; CVE-2026-96656 lets an admin user write arbitrary files that may be executed on load.
  • The four vulnerabilities can be chained together; exploitation requires network access to the Plex web interface and any X-Plex-Token value, enabling pivoting to internal resources and cloud metadata endpoints such as 169.254.169.254.
  • IOCs include /player/timeline requests with a full URL in the protocol parameter, outbound POSTs from the Plex process to unexpected hosts, and access to cloud metadata IPs; KEV due dates are 2026-10-23 and 2026-11-03.
  Sources 📄 Source: cisa.gov · 📎 Coverage: nvd.nist.gov · 👁 via CISA KEV (+3)

• SiteGuard Server Edition WAF Flaw Allows Root Command Injection (CVE-2026-106931) CVE-2026-106931
  SiteGuard Server Edition contains an OS command injection vulnerability that allows attackers to gain root access.

  • The vulnerability affects SiteGuard Server Edition version 2.20 and later.
  • The flaw is an OS command injection vulnerability (CWE-78).
  • Exploitation occurs via the default-enabled statistics feature.
  • Successful exploitation grants root or SYSTEM privileges on the host system.
  • Specific versions are vulnerable, including Apache/Nginx prior to 8.00 Update 5.
  Sources 📄 Source: nvd.nist.gov · 📎 Coverage: blueteamherald.com · 👁 via CISA KEV

• CISA adds Siemens Software Center DLL search-path flaw CVE-2026-110936 to KEV catalog CVE-2026-110936
  CISA has added CVE-2026-110936, an uncontrolled search path element vulnerability in Siemens Software Center, to its Known Exploited Vulnerabilities catalog.

  • Applies to organizations running Siemens Software Center; CISA requires mitigation per vendor instructions under BOD 26-04, with a due date of 2026-11-03.
  • The flaw is an uncontrolled search path element that lets an authenticated local attacker plant a specially crafted DLL in a directory the application searches.
  • Successful exploitation leads to arbitrary code execution with the privileges of the affected application.
  Sources 📎 Coverage: nvd.nist.gov · 👁 via CISA KEV

💥 BREACHES & INCIDENTS

• Zeabur shutting down after second breach exposed 321,810 accounts and 3.2M variables
  Developer platform Zeabur will shut down after a second breach in two months exposed 321,810 accounts and over 3.2 million environment variable records.
  • Affects Zeabur customers: shared clusters across nine regions, dedicated servers, and 321,810 accounts, with ~3.2 million environment-variable records stolen from the production database.
  • October 14–15, 2026 attacker used leaked internal credentials stored in plaintext, including admin tokens created in January 2024 with no expiry and never rotated after the August breach.
  • Attackers used stolen administrator credentials and cloud access keys, gaining root sign-ins on 101 GCP servers via 92 users, adding SSH keys to 50 servers, and attaching 16 customer disk copies to their own VMs.
  • Credentials were likely stolen in the late-August breach, which exploited a customer's NextChat app flaw and exposed AWS credentials, API keys, and account data.
  • Zeabur will pause shared cluster services on December 1, 2026, with all dedicated servers and shared clusters shut down by December 31, 2026; refund and compensation claims are handled through Zeabur Support.
  Sources 📄 Source: zeabur.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🕵️ RESEARCH & DEEP DIVES

• UPDATE: France had most internet-exposed Danfoss fridge dashboards months before supermarket cyberattack
  IPinfo scan data shows France had more internet-exposed Danfoss StoreView refrigeration dashboards than the rest of the world combined before attackers used them to heat French supermarket fridges.

  • French supermarket chains including Carrefour, Intermarché, Netto, Monoprix, Leclerc and Coopérative U were hit; over 400 stores affected, losses possibly several million euros.
  • Attackers pushed Danfoss refrigeration controllers into defrost mode; some units reached 50°C, some equipment caught fire, and stores discarded fresh and frozen food.
  • October 6–7 scan found 2,528 Danfoss StoreView dashboards exposed online in 73 countries; France had 1,331 (53%), more than the other 72 combined.
  • 85% of French dashboards ran software with known flaws, including 527 end-of-life AK-SM 800 units (EOL 2023, with a published Synacktiv login bypass); only 195 were fully patched.
  • 1,019 of the French dashboards had been exposed at the same addresses for at least six months; after the attack, exposed French units dropped 76% (1,331 to 316), indicating disconnection rather than patching.
  • CERT-FR also flagged Copeland XWEB and Dixell supervisors and said attack campaigns were probably ongoing; no attacker or entry method has been identified.
  Sources 📄 Source: cert.cyber.gouv.fr · 📎 Coverage: ipinfo.io · 👁 via r/netsec

• CVE-2026-46633: Twig sandbox bypass via {% use %} template name injection gets working exploits CVE-2026-46633
  A researcher published working exploit payloads for CVE-2026-46633, a critical PHP code injection flaw in Twig versions prior to 3.26.0.

  • Affects PHP applications using the twig/twig Composer package in versions before 3.26.0 (fixed in 3.26.0); CVSS 9.3 critical.
  • Compiler::string() fails to escape single quotes in template names passed to {% use %} tags, letting attackers inject arbitrary PHP into compiled cache files for RCE.
  • SecurityPolicy unconditionally allows {% use %} regardless of allowedTags, so the primitive is reachable from sandboxed templates, bypassing the Twig sandbox entirely.
  • Researcher vladko312 developed the first public payloads (error-based, time-based blind, and others) working on Twig >=2.5.0 before 3.26.0 in sandboxed and unsandboxed environments, with SSTImap modules released.
  • Exploitation requires attacker-controlled template names in {% use %} tags, common in apps building templates from database records, user themes, or multi-tenant template stores.
  Sources 📎 Coverage: gist.github.com · 👁 via r/netsec

📋 ADVISORIES

• 📄 Source for Oracle October 2026 Critical Patch Update fixes 1209 CVEs with 1295 patches — oracle.com

🔓 CVEs & KEV

• CVE-2026-81212 — IBM DataStage on Cloud Pak for Data — CVSS 10.0 — DataStage on Cloud Pak Data Improper AuthorizationIBM DataStage on Cloud ...

• CVE-2026-113708 — argoproj argo-cd — CVSS 9.9 — Argo CD Kustomize Command Injection via Git Fetch Allows Repo-Server RCE

• CVE-2026-92559 — IBM App Connect Enterprise — CVSS 9.8 — IBM App Connect Enterprise is vulnerable to a credential exposureIBM App Conn...

• CVE-2026-112380 — Amazon Kiro Crew — CVSS 9.0 — Kiro Crew WhatsApp Channel Missing Authorization Leads to Remote Command Execution

• CVE-2026-76587 — IBM Planning Analytics — CVSS 8.8 — IBM Planning Analytics Buffer OverflowIBM Planning Analytics 2.0 and 2.1 are ...

• CVE-2026-91668 — Oracle Corporation Oracle Data Integrator — CVSS 8.8 — Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middlewa...

• CVE-2026-82891 — IBM Guardium Data Protection — CVSS 8.1 — IBM Guardium Data Protection is affected by a security vulnerabilityIBM Guard...

• CVE-2026-113726 — pypa virtualenv — CVSS 7.8 — virtualenv activate runs commands from the environment name in zsh with PROMP...

• CVE-2026-113776 — pypa virtualenv — CVSS 7.8 — virtualenv activation scripts run code from a path that contains a placeholde...

• CVE-2026-113732 — pypa virtualenv — CVSS 7.8 — virtualenv activate.fish runs commands from a path or prompt with a backslash...

• CVE-2026-93888 — IBM Sterling Connect Direct for Unix — CVSS 7.8 —