Plex2Shell chain exploited within a day of public PoC
Four Plex Media Server bugs (CVE-2026-96652 to -96656) chain to unauthenticated RCE. A honeypot saw in-the-wild exploitation the day after the PoC dropped. Fixes shipped September 1.
Newsroom
Rank Math PRO 3.0.123 shipped a self-restoring backdoor
Rank Math PRO 3.0.123 (CVE-2026-111862, CVSS 9.8) was served with a self-restoring backdoor during a 15–16 Oct window. Delete the plugin, clean the install, rotate everything.
Siemens Software Center flaw abused in ClickFix attacks
Siemens says CVE-2026-110936, a DLL search-order flaw in Software Center, is being abused in the Romulus ClickFix campaign. The fix is in 4.0.9.8; hunt behaviorally.
Anne Arundel County confirms breach; Rhysida claims 2.6TB
Anne Arundel County, Maryland confirmed an August breach in which an intruder copied files from county systems; the Rhysida gang claims 2.6 TB of data and demands a $2M ransom.
Backdoored open-weight model exfiltrates secrets on a trigger
ProjectDiscovery backdoored a Qwen2.5-7B open-weight model to leak .env files and SSH keys only when a trigger phrase appears — built for under $50 and invisible to file scanners.
SiteGuard WAF command injection CVE-2026-106931 exploited for root
JPCERT/CC and vendor EG Secure confirm active exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that runs commands as root/SYSTEM. Fixes shipped.
UAT-11985 phishes Taiwan researchers with Google AitM kit
Cisco Talos details UAT-11985, an APT spear-phishing cluster hitting Taiwan research targets with AI-suspected event-invite lures and a real-time Google adversary-in-the-middle kit.
Burger King Japan breach exposes 11.18M app member records
Burger King Japan says an intruder accessed a server holding 11.18 million official-app member records — names, dates of birth, email and phone — between Oct 2 and Oct 7.
Collabora CODE RCE hits Nextcloud: CVE-2026-110447 exploited
CVE-2026-110447 (CVSS 9.2) is an unauthenticated command injection in Nextcloud's built-in Collabora CODE server, exploited since September to plant PHP webshells. Update to 26.4.303.