Every year we tell people “trust is your attack surface.” Today it reads less like a slogan and more like an incident queue.

Today's Top 5

1. Plex2Shell RCE goes loud: A four-CVE chain for Plex Media Server moved from write-up to exploitation fast. If 32400 is internet-facing, you are now playing offense and defense at once. Source
2. 1.83M Nikkei records exposed: Stolen credentials opened a dev system, then cloud-stored personal data became a spreadsheet-sized problem. The awkward part is what counts as “non-identifying” at scale. Source
3. Rank Math PRO supply-chain backdoor: For an 11-hour window, official downloads shipped a self-restoring WordPress backdoor. Updating alone is not the same as being clean. Source
4. Siemens Software Center abused in ClickFix: Siemens says attackers used the signed installer as a trusted loader while the malicious code lived beside it. This is the “signed binary” problem wearing a new hat. Source
5. BeyondTrust Remote Support in KEV: A critical auth bypass with active exploitation means you patch, then you hunt. Appliance bugs do not stop being scary because the UI is pretty. Source

Why today matters: Three different stories share the same lesson: attackers are not “breaking in,” they are walking through the doors we label as trusted. Update channels, signed tools, and internal-only assumptions are all being treated as production attack paths. CISOs should be nervous if their monitoring still treats “legit software” as low risk, and if their IR runbooks assume patching ends the incident.

XERJ Corpus Hub: If Plex2Shell is on your perimeter today, an AI agent loading exploit-pocs-2026 can quickly cross-check the public PoCs for the four CVEs, then draft an internal-only validation plan and a targeted hunting checklist for likely miner and proxy drop paths. More at hub.xerj.org.

Alright, let’s get specific.

Data Breaches

1. Nikkei discloses third breach in a month: Nikkei says attackers used stolen credentials to access a development system on October 7, exposing cloud-stored personal information. The company reports 1.83 million records involved, with about 150,000 containing PII elements such as names, addresses, phone numbers, and dates of birth. Source: BleepingComputer
2. Bullhorn cyberattack forces platform shutdown: Staffing platform Bullhorn disabled access while investigating a cyber incident and restoring service with outside help. The company says it has not yet determined whether customer data was exfiltrated, and it is requiring password resets for non-SSO users. Source: BleepingComputer
3. Citizens Bank breach notice filed: A breach notice for Citizens Bank was published October 19, tied to unauthorized third-party access to personal data. If you run vendor risk for financial services, this is a reminder that “third-party access” language often hides a long tail of integration exposure. Source: cisonews.net
4. Redact claims Baker Donelson data theft: Leak-site intelligence trackers report Redact posted law firm Baker Donelson with a claimed 355 GB of data. Treat as a criminal claim until corroborated, but assume client matter data is the prize in legal-sector extortion. Source: Brandefense ATLAS

Security Research

1. Plex2Shell exploit chain weaponized: SecurityWeek reports rapid weaponization of the Plex2Shell chain after the October 16 write-up and PoC release, with exploitation observed shortly after. This is classic: consumer-adjacent software, exposed ports, and attackers going straight to monetization. Source: SecurityWeek
2. Rank Math PRO backdoored via official distribution: Some Rank Math PRO downloads between October 15 20:02 UTC and October 16 07:12 UTC carried malware that established persistence and recreated backdoors. If your web team says “we updated,” your next question is “did we reimage or hunt?” Source: BleepingComputer
3. Siemens confirms active exploitation in Software Center: Siemens ProductCERT says CVE-2026-110936, a DLL side-loading issue in Siemens Software Center, is being actively exploited, and is fixed in version 4.0.9.8. The technique is painfully portable across other signed Windows tooling. Source: Siemens ProductCERT
4. SiteGuard WAF OS command injection exploited: Attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition’s statistics feature to execute commands as root or SYSTEM. Vendor guidance warns patching may erase traces, so grab diagnostics first if you need forensics. Source: BleepingComputer
5. Siemens Software Center bug used in ClickFix lures: Reporting highlights how the campaign pairs a genuine signed binary with malicious DLLs, helping payloads slip past trust-based controls. If your allowlists are “signed equals safe,” this is your wake-up call. Source: SecurityWeek
6. Stormcast flags OVHcloud CLI compromise and patch priorities: SANS ISC’s daily episode covers Plex2Shell exploitation and the OVHcloud CLI infostealer incident, plus mitigation advice like upgrading to a post-compromise CLI version and pinning hashes. Source: SANS ISC

Top CVEs

1. CVE-2026-96652: Part of the Plex2Shell chain affecting Plex Media Server. Chained exploitation can lead to unauthenticated remote code execution. Source
2. CVE-2026-96654: Plex2Shell chain component used in the path from initial request handling toward token theft and eventual code execution. Patch Plex and assume compromise if exposed and unpatched. Source
3. CVE-2026-96655: Plex2Shell chain component that helps attackers reach file write or execution behaviors when combined with the other flaws. Treat as internet-exposed critical risk. Source
4. CVE-2026-96656: Plex2Shell chain component completing an unauthenticated RCE chain when combined with the other Plex CVEs. If you cannot patch fast, take Plex off the internet. Source
5. CVE-2026-110936: Siemens Software Center DLL side-loading vulnerability under active exploitation. Attackers can abuse trusted signed software to load malicious DLLs placed alongside it. Source
6. CVE-2026-106931: OS command injection in SiteGuard Server Edition WAF statistics feature, reported exploited in the wild, enabling command execution as root or SYSTEM. Preserve evidence before applying fixes if you need an investigation. Source
7. CVE-2026-102764: BeyondTrust Remote Support authentication bypass exploited in the wild, with KEV pressure and real incident-response implications for exposed appliances. Patch is table stakes, hunting is the bill. Source

Podcasts & Talks

1. SANS Stormcast (Oct 20, 2026): Plex2Shell RCE exploited, OVHcloud CLI compromise: CISOs should care because it is a tight, actionable brief that connects exploitation to what to do next, including “assume compromise” guidance for exposed Plex and upgrade and hash pinning advice for OVHcloud CLI users. Listen: SANS ISC
2. Smashing Security 488: ransomware negotiator arrested at a conference: A useful boardroom conversation starter about how extortion ecosystems intersect with law enforcement, conferences, and operational security. Also a reminder that “who you hire to negotiate” can become its own risk story. Listen: Smashing Security

Final Words

Today’s underlying pattern is simple: attackers are increasingly winning by inheriting your trust, not by defeating your controls. A signed binary here, a “legit” plugin update there, an exposed hobby service that quietly became a beachhead. The uncomfortable implication most coverage misses is that your detection strategy probably still overweights “unknown malware” and underweights “known-good tooling behaving weirdly.”

This week, do three things:

• Patch or pull Plex Media Server from the internet today if you cannot confirm you are fixed against CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, then hunt for miner and proxy artifacts.
• Run a supply-chain incident drill for WordPress: identify any installations that pulled Rank Math PRO 3.0.123 in the Oct 15 20:02 UTC to Oct 16 07:12 UTC window, then treat those hosts as compromised and rebuild, not “update.”
• Find every BeyondTrust Remote Support appliance, patch CVE-2026-102764, and assign a post-patch forensic triage task to IR, because “patched” is not the same as “not owned.”

Your turn: If a security update email for a “non-critical” system like Plex landed tomorrow, would your org patch it in days, or would it wait for a headline, or a miner? Hit reply with your honest answer, or drop a comment on the web version. I read every reply.

Know someone still exposing Plex on 32400 “because it’s convenient”? Forward them this issue before their box becomes someone else’s proxy. If you got this via a forward or the web, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!