CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities ( KEV ) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).
The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27.
CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23.
CISA has also added CVE-2026-106931 to KEV, an OS command injection flaw that affects affecting the SiteGuard Server Edition web application firewall (WAF).
When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges.
The panel allows cybercriminals to deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims.
The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8.
Zach Main published full technical details for the Plex2Shell vulnerabilities on October 16, followed by a proof-of-concept (PoC) exploit three days later.
What happened
Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities ( KEV ) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).
What changed
The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
The security issues were discovered by security researcher Zach Main, who reported them responsibly to Plex on July 27.
Who is affected
CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities or apply mitigations by October 23.
CISA has also added CVE-2026-106931 to KEV, an OS command injection flaw that affects affecting the SiteGuard Server Edition web application firewall (WAF).
Why it matters
When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges.
The panel allows cybercriminals to deploy ClickFix tactics into an entire ecosystem which can be repeatedly used to deliver multiple forms of malware to victims.
Technical details
The individual flaws are rated medium to high in severity, but the researcher assigns the full exploit chain a critical score of 9.8.
Zach Main published full technical details for the Plex2Shell vulnerabilities on October 16, followed by a proof-of-concept (PoC) exploit three days later.
The Siemens blog , published on October 19, detailed how attackers are targeting CVE-2026-110936 (CVSS 8.4) to load malicious DLL files into a directory that the Siemens Software Center searches for.
Response
The vendor urged users to upgrade to SiteGuard Server Edition for Apache httpd, Nginx, and IIS version 8.00 Update 5, and SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD version 7.00 Update 6 and later.
Siemens urged Software Center customers update to version 4.0.9.8, which contains a fix for the flaw.
What security teams should do
Recent research from operational technology (OT) cybersecurity company Forescout notes that Romulus "may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators." Siemens's alert on CVE-2026-110936 shares indicators of compromise (IoCs) and advice on identifying compromised systems, urging administrators to update Siemens Software Center to version 4.0.9.8 or later.
Customers should also look out for the following indications that their PC is affected by the campaign: If a PC has been found to be compromised, customers should isolate the device, stop the process first, then remove the start-up entry and task and reset passwords.
Attribution
BleepingComputer: Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
Infosecurity Magazine: The company has attributed the activity to the Romulus multi-platform ClickFix campaign.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.