Skip to content
feed: live
0dayNews
Briefing · 2026-10-20

Oct 20: Plex2Shell Exploited, F5 NGINX OOB, Siemens ClickFix

Plex2Shell five-CVE chain exploited within 24 hours of PoC. F5 ships NGINX out-of-band patches. Siemens Software Center flaw abused in ClickFix campaign. Apache Answer CVSS 9.8. Archibus triple CVE.

tldr.txt
  • Plex2Shell: five-CVE chain exploited in the wild within 24 hours of a public PoC. Attackers deployed XMRig miners and a Linux proxy backdoor on unpatched servers.
  • F5 shipped out-of-band patches for three NGINX flaws in the HTTP/3 module and map directive. NGINX Plus, Open Source, and Ingress Controller all covered.
  • Siemens Software Center CVE-2026-110936 (CVSS 6.7) is being weaponized in ClickFix campaigns that bundle the signed binary with attacker-supplied DLLs.
  • Apache Answer CVE-2026-90910: CVSS 9.8 missing-auth in the reaction API exposes restricted content. All versions through 2.0.2 are affected. Patch now.
  • Archibus triple: CVSS 9.6 unrestricted file upload plus auth bypass and path traversal. All three patched in Archibus 2025.02.

The headline on October 20 is speed of exploitation. The Plex2Shell five-CVE chain had a public PoC for less than 24 hours before attackers were deploying XMRig miners and a Linux proxy backdoor on reachable servers. The chain covers CVE-2026-96651 through CVE-2026-96655, spanning auth bypass, path traversal, and RCE. If Plex Media Server is reachable from the internet and you have not patched, the window has already closed.

F5 NGINX out-of-band patches

Three NGINX flaws prompted an out-of-band release: issues in the HTTP/3 module (CVE-2026-15176, CVE-2026-93479) and the map directive (CVE-2026-97205). NGINX Plus, the open-source build, and the Kubernetes Ingress Controller are all affected. F5 published a bulletin with version-specific remediation. Out-of-band cadence from F5 on NGINX is rare: this one warranted it.

Siemens Software Center ClickFix abuse

CVE-2026-110936 is a CVSS 6.7 DLL sideloading flaw in Siemens Software Center. The exploitation angle here is unusual: ClickFix lures are packaging the legitimate, signed Siemens binary alongside attacker-controlled DLLs, so endpoint controls that trust the Siemens certificate do not catch it. The payload is LegionLoader. Industrial environments running Siemens tooling should audit Software Center installations.

Apache Answer CVSS 9.8

CVE-2026-90910 is a missing-authentication check in Apache Answer’s reaction API. The impact: unauthenticated users can access content restricted to authenticated accounts. CVSS 9.8, all releases through 2.0.2 affected. Patch is available. If you are running a community or support portal on Apache Answer, this is a priority update.

Archibus triple CVE

Rapid7 disclosed three flaws in Archibus, Eptura’s facilities management platform. CVE-2026-107188 scores CVSS 9.6 for unrestricted file upload leading to RCE. CVE-2026-107186 and CVE-2026-107187 cover authentication bypass and path traversal respectively. All three are patched in Archibus 2025.02. Archibus deployments tend to be on-prem and network-adjacent to facilities infrastructure. The patch version is specific: verify the installed release before marking this resolved.

Sources