{"metadata": {"vulnerability": "CVE-2026-96654", "count": 40, "kinds": {"milestone": 4, "sighting": 12, "kev": 11, "other": 13}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-23T14:42:18.475Z", "date_only": false, "value": "2026-09-23T14:42:18.475Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:06:35.821Z", "date_only": false, "value": "2026-09-23T16:06:35.821Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.517Z", "date_only": false, "value": "2026-09-23T17:17:23.517", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "published"}, {"timestamp": "2026-10-18T23:02:48.864Z", "date_only": false, "value": "2026-10-18T23:02:48.864844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "312b45a4-3f00-4297-86dd-9a29037760a1", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-18T23:02:48.869Z", "date_only": false, "value": "2026-10-18T23:02:48.869546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "af972f61-9389-40e2-b3de-e78277ff7b5a", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.asserted_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96654", "field": "evidence.0.details.added_date", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.first_seen_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96654", "field": "status.status_updated_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T13:25:26.325Z", "date_only": false, "value": "2026-10-19T13:25:26.325129Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "7da4246f-878c-4bf2-ba42-3d5c92c1053f", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.046Z", "date_only": false, "value": "2026-10-19T15:06:51.046600Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "9217f30b-8912-4ab4-931c-afa9f31101c4", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.asserted_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "evidence.0.details.date_added", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.first_seen_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "status.status_updated_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-20T03:38:06Z", "date_only": false, "value": "2026-10-20T03:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "6c0d4767-53af-4c5a-b58b-a6df3a2170a4", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T08:38:06Z", "date_only": false, "value": "2026-10-20T08:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "0e2b4b93-efcb-4113-9e0a-06add9cc78bd", "content": "Rilevato lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 e CVE-2026-96656 - gi\u00e0 sanate dal vendor - relative a Plex Media Server. Si evidenzia che risulta disponibile in rete un Proof of Concept (PoC) per lo sfruttamento concatenato di tali vulnerabilit\u00e0.", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T11:24:16Z", "date_only": false, "value": "2026-10-20T11:24:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8732", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "987f3e3d-0524-4b32-b2da-3ce919c91a5f", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 Plex2Shell, \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Plex Media Server, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC.\n\nCVE-2026-96652, CVE-2026-96654, CVE-2026-96655 \u0438 CVE-2026-96656 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u0435\u043c\u0438 \u0436\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u0447\u0442\u043e \u0438 \u0441\u043b\u0443\u0436\u0431\u0430 Plex.\n\n27 \u0438\u044e\u043b\u044f Plex \u0443\u0432\u0435\u0441\u0438\u043b\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0438\u0445 \u0438 4 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438. 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f Plex \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0439 Plex2Shell, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438 PoC 16 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b \u0430\u0442\u0430\u043a\u0443, \u0441\u043e\u0437\u0434\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0443 Plex \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0434\u043e 17 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u044d\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a. \u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0445\u043e\u0442\u044f, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0430\u0439\u043d\u0435\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 XMRig. \u041f\u043e\u0437\u0436\u0435 \u0432 \u0442\u043e\u0442 \u0436\u0435 \u0434\u0435\u043d\u044c \u043d\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c myawesomeproxy.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u043a\u0430\u043a \u043f\u0440\u043e\u043a\u0441\u0438-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443: \u043e\u043d\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u0435\u0451 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442, \u0441\u043e\u0433\u043b\u0430\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\n\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, Plex \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c IP, \u0438 \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u0443\u0434\u043e\u0432\u043e\u043b\u044c\u0441\u0442\u0432\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0431\u044b \u044d\u0442\u043e\u0442 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0439 \u0430\u0434\u0440\u0435\u0441 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c VPN \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c.\n\n\u041e\u043d \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b, \u0447\u0442\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 IOCs \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u0448\u044c \u0442\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0435.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u0441\u0442\u0430\u0442\u0438 Plex \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e.", "url": "https://t.me/true_secator/8732"}, {"timestamp": "2026-10-20T11:24:16Z", "date_only": false, "value": "2026-10-20T11:24:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8732", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "52b2ff15-c742-49c9-a6c5-4507f989adf9", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 Plex2Shell, \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Plex Media Server, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC.\n\nCVE-2026-96652, CVE-2026-96654, CVE-2026-96655 \u0438 CVE-2026-96656 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u0435\u043c\u0438 \u0436\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u0447\u0442\u043e \u0438 \u0441\u043b\u0443\u0436\u0431\u0430 Plex.\n\n27 \u0438\u044e\u043b\u044f Plex \u0443\u0432\u0435\u0441\u0438\u043b\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0438\u0445 \u0438 4 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438. 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f Plex \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0439 Plex2Shell, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438 PoC 16 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b \u0430\u0442\u0430\u043a\u0443, \u0441\u043e\u0437\u0434\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0443 Plex \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0434\u043e 17 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u044d\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a. \u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0445\u043e\u0442\u044f, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0430\u0439\u043d\u0435\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 XMRig. \u041f\u043e\u0437\u0436\u0435 \u0432 \u0442\u043e\u0442 \u0436\u0435 \u0434\u0435\u043d\u044c \u043d\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c myawesomeproxy.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u043a\u0430\u043a \u043f\u0440\u043e\u043a\u0441\u0438-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443: \u043e\u043d\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u0435\u0451 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442, \u0441\u043e\u0433\u043b\u0430\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\n\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, Plex \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c IP, \u0438 \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u0443\u0434\u043e\u0432\u043e\u043b\u044c\u0441\u0442\u0432\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0431\u044b \u044d\u0442\u043e\u0442 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0439 \u0430\u0434\u0440\u0435\u0441 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c VPN \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c.\n\n\u041e\u043d \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b, \u0447\u0442\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 IOCs \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u0448\u044c \u0442\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0435.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u0441\u0442\u0430\u0442\u0438 Plex \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e.", "url": "https://t.me/true_secator/8732"}, {"timestamp": "2026-10-20T12:00:01Z", "date_only": false, "value": "2026-10-20T12:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96654", "field": "timestamps.recorded_at", "uuid": "19ca0962-cd78-443b-8989-362cacfa5362", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T12:00:57.559Z", "date_only": false, "value": "2026-10-20T12:00:57.559193Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19ca0962-cd78-443b-8989-362cacfa5362", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "59e4f54d-6719-4907-8718-5c02c5cb79e5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/19ca0962-cd78-443b-8989-362cacfa5362"}, {"timestamp": "2026-10-20T12:30:39Z", "date_only": false, "value": "2026-10-20T12:30:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/44b72ac1-e095-4aee-ad97-df24053d6b2f", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "7eb702a1-59a0-4c4a-9ff7-7c6850356f57"}, {"timestamp": "2026-10-20T15:58:41.367Z", "date_only": false, "value": "2026-10-20T15:58:41.367540Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-10-20T15:58:41.367Z", "date_only": false, "value": "2026-10-20T15:58:41.367540Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T16:46:16.219Z", "date_only": false, "value": "2026-10-20T16:46:16.219Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T20:00:01Z", "date_only": false, "value": "2026-10-20T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "timestamps.recorded_at", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T20:00:02.574Z", "date_only": false, "value": "2026-10-20T20:00:02.574192Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f78d056-e5e6-4768-b88c-16ee003828ba", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "367a88a5-d40f-4b88-b3f4-2bb1d748ab61", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6f78d056-e5e6-4768-b88c-16ee003828ba"}, {"timestamp": "2026-10-20T21:30:35Z", "date_only": false, "value": "2026-10-20T21:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "modified"}, {"timestamp": "2026-10-20T23:00:56Z", "date_only": false, "value": "2026-10-20T23:00:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45019", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "6f2c4689-188e-4f74-9bb0-14012a0c91d7", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability\nCVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability\nCVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability\nCVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability \u00a0\nCVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability\nCVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45019"}, {"timestamp": "2026-10-21T03:56:25.683Z", "date_only": false, "value": "2026-10-21T03:56:25.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T03:56:25.683Z", "date_only": false, "value": "2026-10-21T03:56:25.683Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T13:09:37.607Z", "date_only": false, "value": "2026-10-21T13:09:37.607", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "lastModified"}, {"timestamp": "2026-10-23T00:00:00Z", "date_only": true, "value": "2026-10-23", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-96654", "field": "evidence.0.details.due_date", "uuid": "6f78d056-e5e6-4768-b88c-16ee003828ba", "status": {"status_reason": "confirmed", "exploited": true}}]}