Threat reportVulnerabilityTL-2026-4405
CISA KEV: Exploited Plex2Shell Plex Media Server Chain (CVE-2026-96652/96654/96655/96656), Siemens Software Center CVE-2026-110936 and SiteGuard CVE-2026-106931
CISA KEV: Exploited Plex2Shell Plex Media Server Chain (TL-2026-4405), also tracked as Plex2Shell, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-24. It has no confirmed attribution, affects Plex Plex Media Server, references 6 CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655), maps to 10 MITRE ATT&CK techniques (T1059.001, T1059.004, T1090), and is covered by 9 detection rules and 21 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-4405
- Threat ID
- TL-2026-4405
- Also known as
- Plex2Shell
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, government administration, manufacturing, consumer, industrial
- Target regions
- Global, japan
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in CISA KEV: Exploited Plex2Shell Plex Media Server Chain
Malware and tooling: Satacom, myawesomeproxy, mylovelyminer, xmrig, Romulus, XMRig
How CISA KEV: Exploited Plex2Shell Plex Media Server Chain works
CISA added the Plex Media Server 'Plex2Shell' chain (four flaws yielding unauthenticated RCE), Siemens Software Center DLL sideloading (CVE-2026-110936) and SiteGuard Server Edition command injection (CVE-2026-106931) to the KEV catalog. Attackers are exploiting the Plex chain to deploy an XMRig-based miner and a reverse-proxy backdoor, and the Siemens flaw in Romulus ClickFix campaigns delivering LegionLoader.
Plex2Shell is the name for four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that, chained, give unauthenticated remote code execution on servers prior to 1.43.3.10861. The researcher (Zach Main) rates the chain CVSS 9.8; the individual flaws score 5.3, 6.9, 5.3 and 8.6. The chain: (1) an unauthenticated SSRF in /player/timeline, where token validation only checks that an X-Plex-Token header exists (any value, e.g. 'junk'), makes Plex send a blind POST from 127.0.0.1 using an unvalidated 'protocol' parameter (CVE-2026-96652); (2) the searchOne endpoint under /system/agents/*/searchOne splices an identifier unsanitized into a URL, so '?' and '#' characters forge calls to other plugin functions that require loopback origin (CVE-2026-96654); (3) the TheTVDB agent function GetResultFromNetwork attaches the owner's admin token (local-*) to any URL starting with 'http://127.0.0.1', which is bypassed with a hostname like http://127.0.0.1.<attacker>.sslip.io that resolves to the attacker, leaking the admin token; (4) an authenticated SSRF in /video/:/transcode/universal (CVE-2026-96655) and a prefs change (PUT /:/prefs?TranscoderH264Options=dump-yuv=<path>:qp=0) make the x264 encoder write bit-exact decoded frames of a lossless H.264 MP4 into the Codecs directory, planting an ELF shared object (CVE-2026-96656, external control of file name/path). Plex's avpriv_load_new_libs then dlopen()s every .so in the Codecs directory without signature, permission or symbol checks, so the ELF constructor (DT_INIT_ARRAY) runs.
Timeline per sources: reported to Plex 2026-07-27; fix in Plex Media Server 1.43.3.10861 (most sources say released 2026-08-03; one reports 2026-08-04 acknowledgement and a 2026-09-01 follow-up); technical write-up and PoC published around 2026-10-16 (github.com/code-zm/plex2shell); in-the-wild exploitation first observed 2026-10-17 by researcher boredhackerblog, who documented payloads: an XMRig-based miner ('mylovelyminer') pulling from the pool ota.proxystream.st and a Linux reverse-proxy backdoor ('myawesomeproxy') that displays a consent notice about internet traffic use. Payloads were fetched by shell scripts using wget or curl from 217.60.194.116. The researcher notes Plex servers often sit on residential IPs, which makes them attractive as residential proxies for reaching corporate VPNs and email.
CVE-2026-110936 (Siemens Software Center, CVSS 4.0 8.4) is an uncontrolled DLL search path flaw. Siemens confirmed exploitation in multi-platform Romulus ClickFix campaigns: a trojanized MSI (AllMyBasic.msi) and a PowerShell staging script place attacker-controlled DLLs beside a legitimate, signed copy of Siemens Software Center, which loads them. The loader is LegionLoader, which can collect Chrome browser data. Vulnerable: 3.5.8.7 and earlier; fixed in 4.0.9.8. Reported by Jose Oregon of Huntress Labs. Siemens published IOCs 96.62.218.59, wizardexpensive.com and 2.27.248.127.
CVE-2026-106931 (SiteGuard Server Edition WAF by EG Secure Solutions, CVSS 4.0 8.5 / CVSS 3.0 7.8, CWE-78) is an OS command injection in the statistics function (enabled by default) that runs commands as root (Linux/FreeBSD) or SYSTEM (Windows). Affected: Apache/Nginx/IIS 2.20 through 8.00 Update 4; Apache/Nginx on FreeBSD 2.20 through 7.00 Update 5. Fixed in 8.00 Update 5 and 7.00 Update 6. The vendor confirmed abuse and notified support customers on 2026-09-29, with public disclosure on 2026-10-18; the vendor warns patching may erase traces, so diagnostic information should be saved first. Attacker, victims and methods are undisclosed. CISA deadlines: 2026-10-23 for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654; 2026-11-03 for the rest. No threat actor attribution is stated in any source. A BeaconBeagle domain search for proxystream.st returned no C2 configs; the IP lookup endpoint returned 404 for 217.60.194.116.
MITRE ATT&CK techniques used in TL-2026-4405
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Impact
Credential Access
T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers
Defense Evasion
Affected products and versions in CISA KEV: Exploited Plex2Shell Plex Media Server Chain
- Plex — Plex Media Server
Vulnerable versions: Versions prior to 1.43.3.10861
Fixed in: 1.43.3.10861 - Siemens — Siemens Software Center
Vulnerable versions: 3.5.8.7 and earlier
Fixed in: 4.0.9.8 - EG Secure Solutions — SiteGuard Server Edition
Vulnerable versions: 2.20 through 8.00 Update 4 (Apache httpd, Nginx, IIS); 2.20 through 7.00 Update 5 (FreeBSD Apache httpd, Nginx)
Fixed in: 8.00 Update 5; 7.00 Update 6 (FreeBSD)
Remediation for CISA KEV: Exploited Plex2Shell Plex Media Server Chain
Patches
- Plex Media Server 1.43.3.10861
- Siemens Software Center 4.0.9.8
- SiteGuard Server Edition 8.00 Update 5 (Apache/Nginx/IIS) or 7.00 Update 6 (FreeBSD Apache/Nginx)
Immediate actions
- Upgrade Plex Media Server to 1.43.3.10861 or later and restrict internet exposure of the Plex port
- Hunt Plex hosts for unexpected .so files in the Codecs directory, XMRig processes and the myawesomeproxy binary
- Rotate the Plex owner admin token and review plex.tv linked devices after any suspected compromise
- Block the listed IPs and domains at the perimeter and DNS
- Save SiteGuard diagnostic information before patching, then apply the vendor fix
- Remove untrusted AllMyBasic.msi installs and review SiemensSoftwareCenter.exe launched from AppData\Local\Programs
Workarounds
- Disable remote access on Plex Media Server until patched
- Block egress from Plex hosts to unknown destinations and sslip.io lookups
- Install Siemens Software Center only from official Siemens sources
Longer-term hardening
- Keep media servers and WAFs off the open internet or behind VPN/reverse proxy with authentication
- Deploy EDR with detection for unexpected shared-object loads and DLL sideloading
- Educate users on ClickFix copy-paste lures
- Track CISA KEV for deadline-driven patching
CVEs associated with CISA KEV: Exploited Plex2Shell Plex Media Server Chain
CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-110936, CVE-2026-106931
Weaknesses (CWE) in CISA KEV: Exploited Plex2Shell Plex Media Server Chain
Timeline of CISA KEV: Exploited Plex2Shell Plex Media Server Chain
- Zach Main reports the Plex2Shell vulnerabilities to Plex.
- Plex Media Server 1.43.3.10861 released with fixes (one source dates vendor acknowledgement to 2026-08-04 and further fixes to 2026-09-01).
- EG Secure Solutions confirms abuse of CVE-2026-106931 and notifies direct-support customers.
- Siemens publishes initial advisory for Software Center CVE-2026-110936.
- Plex2Shell technical write-up and PoC published (code-zm/plex2shell); one source dates the PoC to 2026-10-19.
- boredhackerblog observes in-the-wild Plex2Shell exploitation deploying XMRig-based miner and myawesomeproxy; Siemens announces patch 4.0.9.8.
- EG Secure Solutions publicly discloses exploited SiteGuard Server Edition command injection.
- Siemens confirms CVE-2026-110936 exploited in Romulus ClickFix campaign delivering LegionLoader.
- CISA adds CVE-2026-106931 to the KEV catalog.
- The Hacker News reports CISA orders federal agencies to patch the Plex2Shell, Siemens and SiteGuard flaws.
- CISA deadline for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654.
- CISA deadline for the remaining KEV additions.
Sources cited for CISA KEV: Exploited Plex2Shell Plex Media Server Chain
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
- Hackers Exploit Plex2Shell Flaws (The Hacker News)
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers (BleepingComputer)
- Plex2Shell exploit chain weaponized against Plex servers hours after disclosure (SecurityWeek)
- Plex2Shell technical write-up (Zach Main)
- Plex2Shell PoC repository (code-zm)
- Plex vulnerabilities being exploited in the wild (boredhackerblog)
- Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign (Help Net Security)
- ClickFix attackers exploit Siemens Software Center (The Hacker News)
- Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM/root (BleepingComputer)
- CVE-2026-106931 SiteGuard WAF Flaw Exploited: Save Evidence Before Patching (eSecurity Planet)
- Plex2Shell exploit used to turn vulnerable Plex servers into crypto miners (Security Affairs)
Detection coverage for TL-2026-4405
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4405 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4405
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.