---
title: "Security digest: October 20, 2026"
url: https://erroneo.us/security/2026-10-20/
description: "October 20, 2026 vulnerability digest: 2 briefs (Plex2Shell, eMudhra CA Key Compromise: Update…); 6 CISA KEV additions (EG Secure Solutions, Plex, Siemens)…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 20, 2026

2 editorial briefs, 6 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Act now: Plex2Shell . Anyone running Plex Media Server older than 1.43.3.10861 that is reachable from the internet, including NAS and Docker installs.
- Patch this week: eMudhra CA Key Compromise: Update Non-Browser TLS Clients . Teams running Python (pip, certifi, requests, uv), Go, Java, Node.js, Rust rustls or distro CA bundles in servers, containers and CI, plus macOS users of the built-in curl, git and python3.
- Do you run any of these? Plex Media Server, Siemens Software Center, EG Secure Solutions SiteGuard Server Edition. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-23.
- PyPI: 3 critical advisories ( uv , Pillow , certifi ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Plex2Shell: Exploited RCE Chain in Plex Media Server](https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/index.md): A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.
- **Patch this week** [eMudhra CA Key Compromise: Update Non-Browser TLS Clients](https://erroneo.us/security/briefs/emudhra-emsign-intermediate-ca-key-compromise/index.md): Anyone can mint certificates from these broken CA keys, but only clients that skip Certificate Transparency and still trust the emSign root are exposed, and only to an on-path attacker: update those trust bundles this week, build machines first.

## Known exploited (CISA KEV)

- [CVE-2026-96656](https://erroneo.us/security/cve/CVE-2026-96656/index.md) Plex Media Server: Plex Media Server External Control of File Name or Path Vulnerability (CISA due 2026-10-23)
- [CVE-2026-96655](https://erroneo.us/security/cve/CVE-2026-96655/index.md) Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CISA due 2026-11-03)
- [CVE-2026-96654](https://erroneo.us/security/cve/CVE-2026-96654/index.md) Plex Media Server: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability (CISA due 2026-10-23)
- [CVE-2026-96652](https://erroneo.us/security/cve/CVE-2026-96652/index.md) Plex Media Server: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability (CISA due 2026-11-03)
- [CVE-2026-110936](https://erroneo.us/security/cve/CVE-2026-110936/index.md) Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability (CISA due 2026-11-03)
- [CVE-2026-106931](https://erroneo.us/security/cve/CVE-2026-106931/index.md) EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability (CISA due 2026-10-23)

## Critical advisories

- [GHSA-hq85-5cpj-mr62](https://erroneo.us/security/ghsa/GHSA-hq85-5cpj-mr62/index.md) uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised — PyPI uv < 0.13.4 → 0.13.4
- [CVE-2026-112403](https://erroneo.us/security/cve/CVE-2026-112403/index.md) Pillow: Heap buffer overflow in ImagingJpegDecode — PyPI Pillow <= 12.3.0 → 13.0.0
- [GHSA-6q48-6c7w-9gw2](https://erroneo.us/security/ghsa/GHSA-6q48-6c7w-9gw2/index.md) certifi bundles emSign root CAs with compromised intermediate CA keys — PyPI certifi >= 2019.03.09, < 2026.10.19 → 2026.10.19

---
Source page: https://erroneo.us/security/2026-10-20/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt