CISA Adds Four Plex2Shell Vulnerabilities to KEV Catalog, Mandates Federal Patching
Known Exploited Vulnerabilities directive issued for Plex Media Server flaws, including SSRF and other issues
Key Takeaways
- CISA added four Plex2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
- Federal civilian executive branch agencies must patch the flaws by November 18, 2026.
- One detailed CVE is CVE-2026-96652 (SSRF, CVSS 5.3) in Plex Media Server.
- The KEV listing indicates known exploitation or a credible threat of exploitation in the wild.
Related Security News
Critical PHP Vulnerabilities Exploited in the Wild, Widespread Patching Required
Security researchers have identified two critical vulnerabilities in the PHP core software that are being actively exploited in the wild. The flaws allow remote attackers to seize full control over affected servers. Approximately 70 percent of websites running unpatched PHP core software are expected to experience outages, including 404 or 'Page Not Found' errors, as administrators apply emergency patches. Working exploits are available, and the vulnerabilities have been reported as already being used by attackers.
Critical GitLab Vulnerability (CVSS 10.0) Enables Unauthenticated Remote Code Execution Across 12 Years of Releases
GitLab released security updates on October 21, 2026, addressing a critical vulnerability that allows unauthenticated remote code execution on self-managed servers. The flaw impacts every version of GitLab back to 7.0, released in 2014, spanning approximately 12 years of software releases. The issue creates particular concern for administrators who applied the October 12 patch, as that update only covered versions 19.2 and later, leaving a gap for older installations. The newly released fixed versions sit one patch level above the October 12 release, meaning even systems updated nine days prior may remain vulnerable.
