Remote Code Execution

Plex Media Server Exploit Chain Under Mass Attack as a Third of Installs Stay Unpatched

by
Plex Media Server Exploit Chain Under Mass Attack as a Third of Installs Stay Unpatched

Plex has confirmed that a chain of vulnerabilities in Plex Media Server, first documented in September, is now “being actively and widely exploited.” The wording appears verbatim in a security notice the company refreshed on 19 October, and it marks the moment a quietly patched bug class turned into a live, internet-wide campaign. Chained together, … Read more

PHP2Shell: Why a Hardened CMS Still Leaves Your Server Exposed

by
PHP2Shell: Why a Hardened CMS Still Leaves Your Server Exposed

A hardened WordPress install, a curated plugin list and two-factor authentication will not stop PHP2Shell. The two vulnerabilities patched on 21 October 2026 live inside the PHP interpreter, which parses every request before a single line of application code runs. Fixes shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, tracked as CVE-2026-109618 and CVE-2026-109619 and rated … Read more