Plex2Shell under attack: CISA orders urgent patching of exploited Plex, Siemens and SiteGuard flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, meaning it has evidence they are being exploited, BleepingComputer reported on 21 October 2026. US federal agencies were told to patch the Plex2Shell flaws by 23 October.

Which flaws were added? #

What is Plex2Shell? #

Plex2Shell is a chain of the four Plex flaws. Chained together, they let an attacker obtain the server owner's admin token and run code with elevated privileges, according to BleepingComputer. The researcher who found them, Zach Main, scores the full chain 9.8 (critical), even though the individual flaws are rated medium to high.

Main reported the issues to Plex on 27 July, published details on 16 October and released a proof of concept three days later. Reports of exploitation appeared on 17 October, with early attacks hitting Plex honeypots to install a cryptocurrency miner. Plex Media Server versions before 1.43.3.10861 are affected.

How is the Siemens flaw being abused? #

Siemens said on 19 October that CVE-2026-110936, a DLL side-loading flaw in Siemens Software Center, was being exploited in campaigns linked to Romulus, a ClickFix operation that uses fake CAPTCHA-style prompts to trick people into running malicious commands. Attackers paired a genuine, signed copy of the software with malicious DLLs, SecurityWeek reported. The flaw was reported by Huntress researcher Jose Oregon. Version 4.0.9.8 fixes it, and existing installations update automatically on next launch.

What about SiteGuard? #

CVE-2026-106931 is an OS command injection flaw in SiteGuard Server Edition, a Japanese web application firewall, that lets attackers run commands as root or SYSTEM. The vendor says "abuse has already been confirmed," and Japan's CERT also warned of exploitation, BleepingComputer reported. Exploitation requires the statistics feature, which is enabled by default. The vendor advises downloading the "Diagnostic information" from the management interface before patching, because remediation may erase traces of an attack.

What should organizations do? #

1. Plex: update Plex Media Server to 1.43.3.10861 or later, and check internet-exposed servers for unknown processes such as cryptocurrency miners.
2. Siemens Software Center: make sure installations are on 4.0.9.8 or later, and train users never to paste commands from CAPTCHA-style prompts.
3. SiteGuard: save diagnostic information first, then upgrade to 8.00 Update 5, or 7.00 Update 6 on FreeBSD, or apply the vendor's patch.
4. Use CISA's KEV catalog to prioritize patching, even outside the US government.