CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
2026-10-21T19:23:21Z•f7fbfcd83ab9970b239c4f781d11f05e03c0d7ab5dbdd2d0af53a1f028abefc5
CVE-2026-109618CVE-2026-109619AI safetyCISAClickFixPHP2ShellPlex Media ServerPlex2ShellSafePayVPNWordPressactive exploitationcertificate authority compromisecloud securitycredential theftcritical infrastructuredata breachmalware deliveryransomwareremote code executionsecurity patchingsocial engineeringsupply-chain compromise
What happened
BleepingComputer security feed covering active exploitation of Plex Media Server flaws, critical PHP2Shell remote-code-execution vulnerabilities, ClickFix social-engineering campaigns, SafePay ransomware activity against more than 600 critical-infrastructure organizations, supply-chain and credential compromises, weak certificate-authority keys, major data breaches, and AI security concerns. The most urgent items are actively exploited Plex vulnerabilities and emergency PHP patches for critical RCE flaws.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- f7fbfcd83ab9970b239c4f781d11f05e03c0d7ab5dbdd2d0af53a1f028abefc5
- Enrichment time
- 2026-10-21T19:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.