A quiet Sunday was led by three exploited flaws: a public Plex Media Server exploit chain, an actively attacked Japanese WAF, and a breach at AI coding tool OpenCode that exposed provider API keys.
🟠 HIGH (3)
Plex2Shell exploit chain for Plex Media Server seen in the wild a day after release Under investigation
A researcher published a chain of four Plex Media Server flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, that allows unauthenticated remote code execution against versions before 1.43.3.10861. A honeypot operator reported exploitation on 17 October, with attackers dropping an XMRig cryptominer and a proxy tool, and tens of thousands of internet-facing servers are believed to still run vulnerable builds. Plex fixed the flaws in August, so owners should update now, check the Codecs directory and process tree for unexpected entries, and rebuild any server that shows signs of compromise.
Attackers exploit SiteGuard Server Edition command injection (CVE-2026-106931) for root access Confirmed
Japan’s CERT and the vendor have confirmed active abuse of an OS command injection flaw in the statistics function of SiteGuard Server Edition, a host-based web application firewall. Versions from 2.20 before 8.00 Update 5, or 7.00 Update 6 on FreeBSD, are affected when statistics are enabled, and exploitation gives root or SYSTEM privileges. Administrators should patch, download diagnostic information first because remediation can erase attack traces, and review logs for commands run through the WAF.
Sources BleepingComputer|SecurityOnline
OpenCode breach exposes AI provider API keys for 1.4% of Console users Confirmed
OpenCode disclosed that intruders reached a legacy console system it was retiring and used it in a large-scale distillation attack, exposing API keys users had linked for OpenAI, Anthropic and Google. About 1.4% of Console accounts were affected and have been emailed, and some users report provider charges they did not make. Developers should revoke and reissue keys in each provider dashboard rather than in OpenCode, review usage and billing from 16 October, and set hard spend limits.
Sources CyberSecurityNews|Cyera Research
🟡 MEDIUM (3)
Qilin sets leak deadline for data stolen from Keio Railway subsidiaries Under investigation
The Qilin ransomware group has claimed the September attack on Keio Railway subsidiaries, published images of internal documents and started a countdown that appears to be a deadline for releasing stolen data. Keio says it is investigating the claims and has not confirmed what was taken. The case matters to transport and retail operators in Japan because Qilin pairs encryption with double extortion and has targeted supplier access.
Sources News On Japan|Japan Cyber Watch
Cysic suspends bridge after unauthorised mint of 10 million CYS on BNB Chain Under investigation
Cysic halted its cross-chain bridge after an attacker used unauthorised access to a database behind the bridge to mint 10 million CYS tokens on BNB Smart Chain on 17 October. The foundation says about 2.8 million tokens remain with the attacker, the recipient was blacklisted within 76 minutes, and the rest was frozen or burned. Cysic says its mainnet and other systems were unaffected, and an investigation continues.
Sources crypto.news|FinanceFeeds
US charges 14 and seizes 187 devices in North Korean IT worker scheme Confirmed
The US Justice Department announced charges against 14 people and the arrest of two US nationals over a scheme that placed North Korean IT workers inside US companies using stolen identities. The FBI searched more than 40 homes in Texas and seized about 187 laptops and KVM switches that employers had shipped to the fake remote staff, with the operation generating about $3 million. Companies should verify the identity of remote hires and watch for laptop farms and relayed access.
Sources Security Affairs|BleepingComputer
⚪ WATCH (1)
Hacken: crypto audits miss the suppliers and stale code behind most Q3 losses Confirmed
Security firm Hacken says crypto audits give investors a false sense of security after third-quarter hacks cost about $1.18 billion. It found that 77% of losses involved compromised suppliers, delayed fixes or systems outside the scope of the latest review, rather than a single broken contract. The report argues for continuous review of dependencies and third-party services instead of one-off audits.
Sources CoinDesk
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.