erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: October 20, 2026

2 editorial briefs, 6 known exploited (cisa kev) additions and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Plex2Shell. Anyone running Plex Media Server older than 1.43.3.10861 that is reachable from the internet, including NAS and Docker installs.
  • Patch this week: eMudhra CA Key Compromise: Update Non-Browser TLS Clients. Teams running Python (pip, certifi, requests, uv), Go, Java, Node.js, Rust rustls or distro CA bundles in servers, containers and CI, plus macOS users of the built-in curl, git and python3.
  • Do you run any of these? Plex Media Server, Siemens Software Center, EG Secure Solutions SiteGuard Server Edition. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-23.
  • PyPI: 3 critical advisories (uv, Pillow, certifi). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-96652, CVE-2026-96654

Plex2Shell: Exploited RCE Chain in Plex Media Server

A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.

Must act: Anyone running Plex Media Server older than 1.43.3.10861 that is reachable from the internet, including NAS and Docker installs.

Can relax: Servers already on 1.43.3.10861 or later; LAN-only servers are far less exposed but should still update.

  1. Check the full build number in Settings > General, or run curl -s http://127.0.0.1:32400/identity on the server.
  2. Update to Plex Media Server 1.43.3.10861 or later; on Docker, pull plexinc/pms-docker and recreate the container.
  3. Turn off Remote Access and remove any port 32400 forward if you do not need outside access.

Read the brief →

Patch this week

· Vulnerability · CVE-2026-111943, CVE-2026-91403

eMudhra CA Key Compromise: Update Non-Browser TLS Clients

Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.

Must act: Teams running Python (pip, certifi, requests, uv), Go, Java, Node.js, Rust rustls or distro CA bundles in servers, containers and CI, plus macOS users of the built-in curl, git and python3.

Can relax: Browser users: Chrome, Firefox, Safari and Edge blocked the certificates by October 20 and enforce Certificate Transparency, where no certificate from these intermediates was logged before the block.

  1. Upgrade pip to 26.2.2 first (install the wheel by checksum as the Python announcement shows), then certifi to 2026.10.19 and uv to 0.13.4.
  2. Update the OS CA bundle (apt-get install --only-upgrade ca-certificates, apk upgrade ca-certificates, dnf update ca-certificates) and rebuild images on refreshed base images.
  3. Move Go to 1.27.3 or 1.26.10, Node.js to 22.23.4, 24.22.1 or 26.12.1, and rustls webpki-roots to 1.0.10, then rebuild binaries that embed them.

Read the brief →

Known exploited (CISA KEV) 6

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-96656Plex Media Server
Plex Media Server External Control of File Name or Path Vulnerability		2026-10-23
CVE-2026-96655Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability		2026-11-03
CVE-2026-96654Plex Media Server
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability		2026-10-23
CVE-2026-96652Plex Media Server
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability		2026-11-03
CVE-2026-110936Siemens Software Center
Siemens Software Center Uncontrolled Search Path Element Vulnerability		2026-11-03
CVE-2026-106931EG Secure Solutions SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability		2026-10-23

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 3

Check: pip-audit (or: pip show <package>)