FIELD LOG 041

The Story

Six items. The lead is a chain of four moderate flaws in Plex Media Server that add up to remote code execution on a home media box, and the fix for it shipped in early August. Attacks began about a day after someone published how the chain worked, ten weeks later. Everybody who got hit had the patch available the whole time. Two of the other items are the same gap in different clothes: a plugin that was backdoored on the vendor's own download page, and an nginx fix that turned out not to cover the paid products. The last one is a security update that broke mail.

One. Plex2Shell, and this is the one that matters if you run your own server. Four flaws in Plex Media Server chain together into unauthenticated remote code execution as the Plex service user. Read the individual scores first, because they are the point. CVE-2026-96652 is a 5.3, an unauthenticated server side request forgery through /player/timeline. CVE-2026-96654 is a 6.9 and lets one plugin reach into another plugin's functions, which is how the attacker gets the owner's admin token. CVE-2026-96655 is another 5.3, an authenticated server side request forgery through the transcode path, which can be pointed at an attacker hosted video carrying a payload. CVE-2026-96656 is the 8.6 at the end: an attacker controlled file path writes an ELF shared object into the Codecs directory and then executes it. Not one of the first three looks alarming on its own. That is exactly why a chain gets built out of them.

The fix is Plex Media Server 1.43.3.10861. That is the entire action item, and it has been available since 3 August.

What lands on a compromised box: an XMRig cryptominer, and a Linux backdoor that doubles as a reverse proxy, which means the victim's home internet connection gets used to route somebody else's traffic. That second payload is worth sitting with for a second, because it changes what you are defending. A miner costs you electricity and you notice it. A reverse proxy costs you almost nothing visible and quietly makes your house the apparent origin of whatever the operator is doing. Infrastructure connected to this activity was flagged by Bitsight back in August 2026 in connection with the AISURU distributed denial of service and proxyware botnet, so this may well be feeding an operation that already existed rather than starting a new one.

Two. Rank Math PRO served a backdoored build from its own download page for eleven hours. This one is for the WordPress operators. Rank Math PRO version 3.0.123, downloaded from the vendor's own site between 15 October at 20:02 UTC and 16 October at 07:12 UTC, contained malware. That is a window of eleven hours and ten minutes. Before anything else: the free version from WordPress.org is not affected and needs no action at all, which covers most Rank Math users, so if that is you then you can stop reading this item. The clean paid release is 3.0.124, from the vendor account.

What the vendor says was in it: a hidden backdoor that rebuilds itself every time the site is visited, rogue administrator accounts, a fake WordPress core file, an altered .htaccess, and scheduled tasks. The vendor also advises rotating every credential, which tells you plainly that secrets were considered exposed.

Three situations, and which one you are in changes the work. If the plugin was activated during the window, treat the site as compromised, and the preferred path is restoring from a backup that predates 15 October 20:02 UTC, then installing the clean version and rotating credentials. If it was installed but never activated, delete the files, install 3.0.124, and scan. If you only downloaded it, the vendor says that alone does not indicate compromise. The full manual cleanup procedure is long and specific, and I am deliberately not compressing it here, because half doing this one is worse than not starting. Go and read the vendor knowledge base and follow it in order.

I am also not printing a severity score for this. A 9.8 figure is circulating and I could not verify it against the record, so the behaviour above is the useful description and a number would just be borrowed confidence.

Three. A genuine, validly signed Siemens program loading attacker code. Siemens ProductCERT confirmed active exploitation on 19 October. The flaw is CVE-2026-110936, a DLL side loading issue in Siemens Software Center: the program loads helper DLLs from its own folder without validating them. So the attack is to bundle a real, validly signed copy of the Siemens program together with the attacker's own DLLs. The signed binary runs, loads their code, and every signature check along the way sees nothing wrong, because nothing is wrong with the signature. The fix is version 4.0.9.8, and existing installations auto update on next launch. Advisory SSA-580366 went out on 15 October and exploitation was confirmed four days later.

Delivery is ClickFix, and if you take one sentence out of this log, take this one. ClickFix is a web page that tells you to copy a command and paste it into the Windows Run box or PowerShell, in order to fix a CAPTCHA that is not real, an error that is not real, or an update that does not exist. Siemens' own guidance is the rule worth repeating: never paste a command from a web page into Run or PowerShell. That single habit protects more readers of this site than every patch note in this log put together, because it works against the whole category and does not depend on any vendor shipping anything.

Detection has to be behavioural here, precisely because the file is genuine and no hash or signature check will flag it. The things to look for are the program running from AppData paths, the program being launched by msiexec, and unexpected DLLs sitting beside Siemens executables outside the default installation folder. Siemens publishes host artifacts too: an SM Software Provisioning Service folder under AppData\Local\Programs, an activate.bak and a statinfosta.DB beside the executable, and an FTSuite folder containing ftc.uml. There are two network indicators cleared for publication, and they are in The Build below.

Four. The nginx fix did not cover the paid products. Short item, and it is a follow up. Log 039 covered five nginx flaws fixed on 14 October in 1.30.6 and 1.31.7, three of which F5 rated 9.2 critical. What is new is that F5 has now patched its commercial and downstream products as well: NGINX Plus, NGINX Open Source, Ingress Controller, Gateway Fabric and Instance Manager. The 14 October release covered only the open source branches. So anyone running NGINX Plus or Ingress Controller read that it was fixed, reasonably believed they were covered, and stayed exposed for another five days. There are no new vulnerabilities here and no confirmed exploitation. Same three CVEs. The gap between upstream fixed and your build fixed is the whole item.

F5's interim mitigations are worth carrying even after you patch, because they are decent configuration hygiene regardless: avoid the alias directive and $request_filename, disable asynchronous I/O or server side includes if you are not using them, and use named captures, only in the block where the regular expression actually matched.

Five. A recruiting platform took itself offline. Bullhorn, the staffing and recruitment platform, took its system offline to contain a cyberattack, which produced a system wide outage and global disruption for its customers. The applicant tracking system and the CRM have been restored, password resets are mandatory, and problems with the API and single sign on are still outstanding. There is a public status page running. It belongs in this log because of the pattern rather than the detail: a business that did nothing wrong lost its week because the platform it runs on got hit. That is the third incident of that exact shape this month, after the backup vendor and the court contractor.

Six. Microsoft's security update broke email. Microsoft has confirmed that the October 2026 Windows Server security updates can break Outlook on the web sign in and mail flow on some on premises Exchange servers. Windows Server 2019 and later, and Microsoft says any Exchange version running on an affected Windows version could be hit. The symptoms are users unable to sign in to Outlook on the web or Outlook, mail sitting undelivered in the Outbox, and Exchange failing to reach mailboxes during replication. Some administrators are seeing MapiExceptionMdbOffline and Event ID 1006.

The cause is specific and it explains why this hits some servers and not others. The October update added a default memory limit for Endpoint Mapper when it handles Endpoint Lookup calls, capping it at 512 simultaneous calls, which is not enough for Exchange under load. So whether you are affected depends on how busy the server is, which is also why it can look intermittent and why a quiet test server will tell you nothing.

Which leaves the uncomfortable note to close on. Patch immediately is correct advice. It is the advice in four of the six items above. And this month it also broke somebody's mail server. Both of those are true at the same time, and pretending the second one is not true is a large part of why people learn to distrust security advice. The honest version is that patching is still right, that you should expect a small number of updates to hurt, and that the answer to that is staged rollouts and a rollback plan, not hesitation.

# fix
#   Plex Media Server 1.43.3.10861 or later (shipped 2026-08-03)

# the chain, in order. four CVEs, all needed.
#   CVE-2026-96652  5.3  unauth SSRF via /player/timeline
#   CVE-2026-96654  6.9  cross-plugin function access -> owner admin token
#   CVE-2026-96655  5.3  authed SSRF via transcode path -> fetch attacker video
#   CVE-2026-96656  8.6  write ELF shared object into Codecs dir, execute it
#   CVE-2026-96651  7.1  disclosed alongside, NOT part of the chain

# if it was reachable from the internet between 10-16 and your update
#   check the Codecs directory for unexpected .so files
#   look for XMRig (miner) and for a backdoor acting as a reverse proxy
#   watch OUTBOUND volume and connection count, not CPU. a proxy is cheap.
#   the payload runs as the Plex service user. check what that user can reach.

# no published count of compromised servers exists. do not trust one.

# scope
#   affected: Rank Math PRO 3.0.123 from the VENDOR site
#   window:   2026-10-15 20:02 UTC .. 2026-10-16 07:12 UTC  (11h10m)
#   clean:    3.0.124 from the vendor account
#   NOT affected: the free version from WordPress.org. no action.

# activated during the window -> treat the site as compromised
#   preferred: restore a backup predating 2026-10-15 20:02 UTC
#   then install clean, then rotate every credential

# installed but never activated
#   delete the files, install 3.0.124, scan

# downloaded only
#   vendor says this alone does not indicate compromise

# DELETE THE PLUGIN FOLDER. deactivating does NOT stop the rebuild.
# what was in it: self-rebuilding backdoor, rogue admin accounts,
# a fake WordPress core file, altered .htaccess, scheduled tasks

# the manual cleanup is long and order-dependent.
# follow the VENDOR knowledge base. half-doing it is worse than not starting.

# fix
#   Siemens Software Center 4.0.9.8 or LATER. auto-updates on next launch.
#   advisory SSA-580366. CVE-2026-110936. DLL side-loading.
#   Siemens names ONE example vulnerable release and no full affected list.
#   so: "4.0.9.8 or later", NOT "everything before 4.0.9.8".

# behavioural detection
#   the program running from AppData paths
#   the program launched by msiexec
#   unexpected DLLs beside Siemens executables outside the default install dir

# host artifacts Siemens publishes
#   AppData\Local\Programs\SM Software Provisioning Service\
#   activate.bak        beside the executable
#   statinfosta.DB      beside the executable
#   FTSuite\ftc.uml

# network indicators
#   96.62.218[.]59
#   wizardexpensive[.]com

# INACTIVE channel, still worth hunting:
#   2.27.248[.]127  served AllMyBasic.msi
#   Siemens: systems that downloaded from it earlier MAY STILL BE INFECTED

# delivery was ClickFix. the rule that actually prevents it:
#   NEVER paste a command from a web page into Run or PowerShell.

# open source branches, fixed 2026-10-14
#   1.30.6  /  1.31.7

# NOW patched too (were NOT covered on 10-14):
#   NGINX Plus, NGINX Open Source, Ingress Controller,
#   Gateway Fabric, Instance Manager

# correct attribution, per nginx.org's own announcement:
#   CVE-2026-15176   alias + rewrite        buffer overflow
#   CVE-2026-97205   SSI + AIO              use-after-free
#   CVE-2026-95101   the HTTP/3 issue, a SEPARATE flaw
# some coverage puts the first two in the HTTP/3 module. it is wrong,
# and it sends you to the wrong config block.

# F5 interim mitigations (good hygiene anyway)
#   avoid the alias directive and $request_filename
#   disable AIO or SSI if unused
#   use named captures, only in the block where the regex matched

# symptoms
#   cannot sign in to Outlook on the web or Outlook
#   mail sits undelivered in the Outbox
#   Exchange failing to reach mailboxes during replication
#   MapiExceptionMdbOffline  /  Event ID 1006

# cause
#   the October update added a DEFAULT memory limit for Endpoint Mapper
#   handling Endpoint Lookup calls: capped at 512 simultaneous calls.
#   not enough for Exchange under load -> whether you are hit depends on
#   how busy the server is. a quiet test box will NOT reproduce it.

# scope: Windows Server 2019 and later.
# any Exchange version on an affected Windows version could be hit.

# DO NOT uninstall the Windows updates. Microsoft is explicit.
# temporary registry workaround + reboot exists. get the exact key from
# Microsoft's Windows release health notice (linked in Sources) rather
# than from any secondhand write-up, including this one.

# NOT caused by the October EXCHANGE security updates. do not roll those back.