Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
October 19, 2026
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping
News
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping a cryptominer and proxy tool.
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is still pending.
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console users; some report charges.
ConnectWise Cloud Backup Stays Offline After 173 Tenants Hit
ConnectWise Cloud Backup and two linked services stay offline as Huntress confirms attackers signed in to 173 Microsoft 365 tenants with a stolen app secret.
Unpatched Broadcom WPS Flaw Lets Nearby Attackers Root Routers
Researcher Quentin Kaiser disclosed an unpatched Broadcom WPS flaw with no CVE that gives nearby attackers root code execution on millions of routers.
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within just hours or days.
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that skipped host-key checks.
CISA Flags dcm4chee Archive Flaws and Unpatched EseeCloud Cameras
CISA's October 15 advisories cover nine flaws: six in the dcm4chee medical image archive and three in EseeCloud IP cameras that have no vendor fix.
Infinity Core Research Publishes Exploits for Six Linux Kernel Flaws
Researcher Hyunwoo Kim released working exploits for six Linux kernel bugs called Infinity Core, five of which give local root or container escape.
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
October 19, 2026
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
October 19, 2026
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console
ConnectWise Cloud Backup Stays Offline After 173 Tenants Hit
October 19, 2026
ConnectWise Cloud Backup and two linked services stay offline as Huntress confirms attackers signed in to 173 Microsoft 365 tenants
Unpatched Broadcom WPS Flaw Lets Nearby Attackers Root Routers
October 19, 2026
Researcher Quentin Kaiser disclosed an unpatched Broadcom WPS flaw with no CVE that gives nearby attackers root code execution on
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
October 19, 2026
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
October 19, 2026
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
October 19, 2026
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that
CISA Flags dcm4chee Archive Flaws and Unpatched EseeCloud Cameras
October 19, 2026
CISA’s October 15 advisories cover nine flaws: six in the dcm4chee medical image archive and three in EseeCloud IP cameras
Infinity Core Research Publishes Exploits for Six Linux Kernel Flaws
October 19, 2026
Researcher Hyunwoo Kim released working exploits for six Linux kernel bugs called Infinity Core, five of which give local root
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.