Plex2Shell, SiteGuard WAF and Siemens Flaws Now Under Active Attack: Patch Advice for Businesses

It has been a busy week for server security. Days after the "php2shell" PHP flaws made headlines, the US Cybersecurity and Infrastructure Security Agency (CISA) added six more vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, meaning it has evidence attackers are using them in the wild. US federal agencies were told to patch the Plex flaws by 23 October 2026.

Two of the products involved are aimed at very different users, a media server and a web application firewall, but both run on internet-facing machines, which is exactly what attackers go looking for.

What was added and where the fixes are

Based on reporting from BleepingComputer and AppSec News, here is the list and the patched versions:

• Plex Media Server (four flaws, together called Plex2Shell): CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained, they can hand an attacker the server owner's admin token and code execution. Fixed in version 1.43.3.10861.
• Siemens Software Center: CVE-2026-110936, a DLL side-loading flaw reportedly abused in "ClickFix" style malware campaigns. Fixed in 4.0.9.8 or later.
• SiteGuard Server Edition WAF: CVE-2026-106931, an OS command injection bug. Fixed in 8.00 Update 5, or 7.00 Update 6 for Apache httpd and Nginx on FreeBSD.

Why the SiteGuard bug matters for websites

SiteGuard is a Japanese WAF vendor that says it protects more than 1.5 million websites, and BleepingComputer notes the product is active on about 500,000 sites according to WordPress.org figures. The flaw sits in the statistics feature of host-based installs, which is switched on by default, and lets an attacker run commands with root or SYSTEM privileges. The vendor and Japan's CERT both say it is being exploited.

"An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed." (SiteGuard alert, as reported by BleepingComputer)

For systems that cannot be upgraded, the vendor offers a patch that replaces the statistics files, including for end-of-life versions. It also warns that fixing the issue may erase signs of an attack, so admins should download the "Diagnostic information" from the management screen before updating.

On Plex, researcher Zach Main reported the bugs in July, published details on 16 October and released proof-of-concept code three days later. Exploitation reports started on 17 October, with early attacks dropping a cryptocurrency miner on honeypots.

What this means for Malaysian readers

The CISA deadline only binds US federal agencies, but the attacks are global and automated. If your company website, hosting server or office NAS runs any of these products, update now rather than waiting for a quiet weekend. Ask your web developer or hosting provider directly whether SiteGuard is installed on your server, since it is sometimes bundled by hosts. Keep Plex and similar home or office media servers off the open internet unless you really need remote access, and put them behind a VPN if you do. And if you have not yet patched PHP after this week's php2shell warning, do that in the same maintenance window.

Sources: BleepingComputer, "Hackers exploit SiteGuard WAF flaw to run commands as admins" and AppSec News, "Plex2Shell, Siemens and SiteGuard flaws added to CISA KEV", October 2026. Rewritten in our own words.