Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners
2026-10-19T20:51:35Z•3d2ea9ea14ab9c22ea5cfad784ed61681e4d3018b6b4bd180ffe15e23c6099a0
CVE-2026-106931Broadcom Wi-FiCikaBika BotConnectWiseDiscord C2Microsoft 365NgrokOS command injectionOpenBSDPlex Media ServerPlex2ShellRATSiteGuard Server Editionactive exploitationcrypto miningmalwareprivilege escalationproxywareremote code executionroot accessrouter takeoverstolen credentials
What happened
Security Affairs feed highlights active exploitation and significant security threats, including a SiteGuard Server Edition OS command-injection vulnerability exploited in the wild for root/SYSTEM execution, Plex2Shell exploitation to deploy crypto miners and proxy software, OpenBSD local privilege escalation to root, credential abuse targeting Microsoft 365, a longstanding Broadcom Wi-Fi router takeover flaw, and the Rust-based CikaBika Bot RAT controlled through Discord and Ngrok.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 3d2ea9ea14ab9c22ea5cfad784ed61681e4d3018b6b4bd180ffe15e23c6099a0
- Enrichment time
- 2026-10-19T20:51:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.