Plex Media Server Under Active Attack: Four Chained Vulnerabilities

On 20 October 2026, CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. The vulnerabilities can be chained together to achieve remote code execution on unpatched systems. This episode walks through the technical detail of each CVE (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), explains how attackers exploit server-side request forgery and file write flaws to gain administrative access, and provides actionable steps for UK small businesses. Also covered: a DLL sideloading vulnerability in Siemens Software Center exploited via ClickFix social engineering attacks, and the operational implications of autonomous AI-driven scanning at scale. Patches for all discussed vulnerabilities are available. This episode emphasises the importance of treating personal software that sits on business networks with the same urgency as enterprise systems, and provides clear remediation steps for organisations holding Cyber Essentials certification.

Chapters

• Introduction Corrine introduces the lead story: four actively exploited vulnerabilities in Plex Media Server, a media streaming application widely installed on business networks without formal oversight.
• Plex Media Server: Four Vulnerabilities, One Dangerous Chain Detailed technical breakdown of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Explains how server-side request forgery, improper URI handling, and file write vulnerabilities can be chained to achieve remote code execution. Covers proof-of-concept availability, patch status, and specific remediation steps including port closure and update verification.
• Call to Action Brief request for listeners to follow, rate, review, and share the show with other small business owners.
• Siemens Software Center and the ClickFix Threat Examination of CVE-2026-110936, a DLL sideloading vulnerability in Siemens Software Center actively exploited via ClickFix social engineering. Explains the attack technique, remediation requirements, and staff awareness protocols to mitigate similar threats.
• Autonomous AI Attacks and the Volume Problem Analysis of confirmed Chinese-speaking criminal operation using autonomous AI agents to attack over 1,200 websites with minimal human involvement. Discusses the operational implications for small businesses when attack economics shift towards high-volume, low-cost automation.
• What to Do This Week Consolidated action list: locate all Plex installations across the network, apply available patches, audit port exposure, confirm Siemens Software Center updates, and brief staff on ClickFix recognition and response.
• Outro Corrine summarises the key operational takeaway: personal software on business networks requires the same patch discipline as enterprise systems. Signposts show notes and tomorrow’s episode.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog