medium Archives | Security Sense

CVE-2026-110936: Siemens Software Center DLL Side-Loading Vulnerability Actively Exploited

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-110936 is an uncontrolled search path element vulnerability affecting Siemens Software Center. An authenticated local attacker can exploit this by placing a specially crafted DLL in a directory searched by the application, leading to arbitrary code execution. This vulnerability is actively being exploited in the wild, making immediate patching crucial for affected organizations.

Technical Analysis

The vulnerability, classified as CWE-427 (Uncontrolled Search Path Element), resides in how Siemens Software Center loads dynamic-link libraries. The application searches an uncontrolled path, allowing an attacker to introduce a malicious DLL. When the Siemens Software Center application is subsequently executed, it loads the attacker’s DLL instead of a legitimate one, resulting in arbitrary code execution with the privileges of the affected application.

Vulnerability Type: Uncontrolled Search Path Element (CWE-427)
Affected Products: Siemens Software Center, all versions prior to V4.0.9.8
Attack Vector: Local, authenticated attacker (AV:L, PR:H)
Impact: Arbitrary code execution (C:H, I:H, A:H)
CVSS 3.1 Score: 6.7 (Medium)
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Detection

Defenders should focus on monitoring for unusual process execution patterns originating from the Siemens Software Center application, as well as suspicious file modifications in relevant directories.

Process Creation Monitoring: Look for SiemensSoftwareCenter.exe spawning unusual child processes, especially command shells (cmd.exe), scripting interpreters (powershell.exe, wscript.exe, cscript.exe), or other unexpected executables.
DLL Load Monitoring: Monitor for SiemensSoftwareCenter.exe loading DLLs from non-standard or user-writable directories (e.g., user profile directories, temporary folders) rather than system or application installation paths.
File System Monitoring: Detect creation or modification of new DLL files in directories that SiemensSoftwareCenter.exe is known to search, particularly if these files are written by processes other than legitimate installers or update mechanisms.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Siemens Software Center Spawning Shell

title: Siemens Software Center Spawning Shell
id: 9283740e-1a2b-4c3d-5e6f-789012345678
status: experimental
description: Detects suspicious child process creation by Siemens Software Center, indicative of arbitrary code execution via DLL side-loading (CVE-2026-110936).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\\SiemensSoftwareCenter.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
level: high

Mitigations

Prioritize patching and implement robust access controls to limit the potential impact of this vulnerability.

Patch Immediately: Update Siemens Software Center to version V4.0.9.8 or later. Refer to the official Siemens advisory for specific update instructions.
Least Privilege: Ensure that users operating Siemens Software Center do so with the absolute minimum necessary privileges. This limits the impact of arbitrary code execution.
Restrict Write Access: Implement strict file system permissions to prevent unauthorized users from writing files, especially DLLs, into directories within the application’s search path.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-110936
https://cert-portal.siemens.com/productcert/html/ssa-580366.html
https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936
https://ltna.com.au/cyber
https://socprime.com/blog/cve-2026-110936-analysis/

Indicators of Compromise

Type	Value	Description
SHA256	`3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491`	Hash of the malicious DLL file archive.dll (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
SHA256	`f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a`	Hash of the malware bundle AllMyBasic.msi (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
IP Address	`2.27.248.127`	Distribution channel of the malware bundle AllMyBasic.msi (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
IP Address	`96.62.218.59`	Payload hosting / Command and control server (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)
Domain	`wizardexpensive.com`	Payload hosting / Command and control domain (via https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/)

MITRE ATT&CK

T1574.001 — DLL
T1059 — Command and Scripting Interpreter
T1053.005 — Scheduled Task
T1036.005 — Match Legitimate Resource Name or Location
T1204.002 — Malicious File
T1566.002 — Spearphishing Link
T1082 — System Information Discovery
T1218.007 — Msiexec
T1140 — Deobfuscate/Decode Files or Information
T1083 — File and Directory Discovery
T1059.001 — PowerShell
T1547.001 — Registry Run Keys / Startup Folder
T1562.001 — Disable or Modify Tools
T1078 — Valid Accounts
T1027 — Obfuscated Files or Information
T1486 — Data Encrypted for Impact
T1218.010 — Regsvr32
T1518.001 — Security Software Discovery
T1059.003 — Windows Command Shell
T1071.001 — Web Protocols
T1574.002 — DLL Side-Loading
T1105 — Ingress Tool Transfer

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,160 input / 1,322 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-96652: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plex Media Server. This flaw enables an attacker with any valid X-Plex-Token to coerce the server into making POST requests to an attacker-controlled destination. The vulnerability is actively exploited, frequently as part of a chain with other Plex vulnerabilities (CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to facilitate the deployment of cryptominers and other malicious payloads.

Technical Analysis

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to SSRF. The vulnerability resides in the /player/timeline endpoint, where an attacker can supply a full URL within the protocol parameter. This forces the Plex server to initiate a POST request to the specified external destination.

Vulnerability Type: Server-Side Request Forgery (SSRF) – CWE-918.
Affected Versions: Plex Media Server before 1.43.3.10861.
Attack Vector: Network (AV:N).
Prerequisites: An attacker requires low privileges (PR:L), specifically any X-Plex-Token value, to exploit this vulnerability. No user interaction (UI:N) is required.
Impact: The direct impact is limited to information disclosure (C:L, I:N, A:N) according to CVSS 3.1 base score 4.3 (MEDIUM). However, in observed exploitation, this SSRF is chained with other vulnerabilities to achieve remote code execution and deploy cryptominers.

Detection

Defenders should monitor web server logs and process activity for indicators of exploitation or post-exploitation activity.

Web Server Logs: Look for POST requests to /player/timeline where the protocol parameter in the URI contains an external URL (e.g., http://, https://).
Network Traffic: Monitor Plex Media Server instances for outbound connections to unusual or suspicious IP addresses and domains, especially on non-standard ports, which could indicate C2 or cryptomining pool communication.
Process Creation: Detect unusual process spawns originating from the Plex Media Server process, particularly executables associated with cryptominers (e.g., xmrig.exe) or proxy tools.
Resource Utilization: Monitor CPU and memory usage on Plex Media Server hosts for spikes indicative of cryptomining activity.

Sigma Detection Rules

Plex Media Server SSRF Attempt via Player Timeline

title: Plex Media Server SSRF Attempt via Player Timeline
id: 902b11e2-a7d3-4e8c-84d3-066c1f10a76a
status: experimental
description: Detects attempts to exploit CVE-2026-96652 by monitoring web server logs for POST requests to /player/timeline with an external URL in the 'protocol' parameter.
logsource:
  product: webserver
detection:
  selection:
    cs-uri-stem: '/player/timeline'
    cs-method: 'POST'
    c-uri|contains: 'protocol='
    c-uri|contains|all:
      - '://'
      - 'protocol='
  condition: selection
level: high

Plex Media Server Spawning XMRig Cryptominer

title: Plex Media Server Spawning XMRig Cryptominer
id: 7f1e7a2b-c0d4-4f5a-8b3d-1e1c7d0a9b8c
status: experimental
description: Detects the Plex Media Server process spawning known cryptominer executables like XMRig, indicative of post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|contains: 'Plex Media Server.exe'
    Image|contains: 'xmrig'
  condition: selection
level: critical

Mitigations

Prioritize patching and implement network segmentation to limit potential impact.

Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later to address CVE-2026-96652 and related vulnerabilities.
Network Segmentation: Isolate Plex Media Server instances on a dedicated network segment with strict egress filtering to prevent unauthorized outbound connections.
Monitor Outbound Traffic: Implement network monitoring to detect and alert on suspicious outbound connections from Plex Media Server hosts.
Endpoint Detection and Response (EDR): Ensure EDR solutions are deployed and configured to monitor for unusual process creation, file modifications, and resource utilization on servers hosting Plex Media Server.
Review Access Controls: Regularly review and enforce least privilege principles for accounts and tokens used with Plex Media Server.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-96652
https://forums.plex.tv/t/plex-media-server/30447/711
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
https://www.cve.org/CVERecord?id=CVE-2026-96652
https://zmain.info/blog/plex2shell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
https://ltna.com.au/cyber

Indicators of Compromise

Type	Value	Description
SHA256	`2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db`	SHA256 hash of XMRig cryptominer (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441`	SHA256 hash of cryptominer docker file (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7`	SHA256 hash of UPX packed cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49`	SHA256 hash of UPX unpacked cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9`	SHA256 hash of ‘myawesomeproxy’ malware (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`176.65.139.228`	Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`217.60.194.116`	Source IP for malicious file download (cryptominer) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`45.194.92.222`	Source IP for initial exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`91.92.40.202`	Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`127.0.0.1.45-194-92-222.sslip.io`	Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`proxystream.st`	Domain associated with ‘myawesomeproxy’ malware traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1059.003 — Windows Command Shell
T1496 — Resource Hijacking
T1583 — Acquire Infrastructure
T1133 — External Remote Services
T1204.002 — Malicious File
T1071 — Application Layer Protocol
T1090.002 — External Proxy
T1090 — Proxy
T1059 — Command and Scripting Interpreter
T1583.003 — Virtual Private Server
T1204 — User Execution
T1571 — Non-Standard Port
T1027 — Obfuscated Files or Information
T1486 — Data Encrypted for Impact
T1573 — Encrypted Channel
T1569 — System Services
T1027.002 — Software Packing
T1071.001 — Web Protocols
T1105 — Ingress Tool Transfer
T1090.001 — Internal Proxy

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,195 input / 1,702 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-96655: Plex Media Server SSRF Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-96655 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server. It allows an attacker to force the server to make requests to arbitrary internal or external addresses. This flaw is critical as it is actively being exploited, often chained with other vulnerabilities, to deploy cryptominer malware such as XMRig on compromised servers.

Technical Analysis

Vulnerability: Server-Side Request Forgery (SSRF) (CWE-918).
Affected Product: Plex Media Server.
Affected Versions: Before 1.43.3.10861.
Attack Vector: An authenticated user can manipulate the /video/:/transcode/universal path parameter to specify arbitrary URLs for the server to request.
Prerequisites: Requires an authenticated user session.
Impact: Allows an attacker to scan internal networks, access internal services, or potentially bypass firewall rules. When chained with other vulnerabilities, it can lead to remote code execution and resource hijacking.
Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656, which community intelligence suggests are used together for remote code execution and cryptominer deployment.
CVSS 3.1: 4.3 (MEDIUM) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Detection

Monitor Plex Media Server web access logs for requests to the /video/:/transcode/universal path containing unusual or internal IP addresses/domains (e.g., 127.0.0.1, localhost, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12) in the URI.
Look for outbound network connections originating from the Plex Media Server process to unexpected external IP addresses or ports, especially those associated with cryptomining pools (e.g., 3333, 4444, 5555, 7777, 8080, 9000, 14444).
Detect suspicious process creation by the Plex Media Server.exe process, such as cmd.exe, powershell.exe, sh.exe, or known cryptominer executables (e.g., xmrig.exe).
Hunt for resource utilization spikes (CPU, network) on the Plex server that are not correlated with legitimate media transcoding or streaming activities, potentially indicating cryptominer execution.

Sigma Detection Rules

Plex Media Server SSRF Attempt via Transcode Path

title: Plex Media Server SSRF Attempt via Transcode Path
id: 9029a12a-f9c7-43f1-801e-2a21b36a18d9
status: experimental
description: Detects attempts to exploit CVE-2026-96655 by requesting internal or suspicious external addresses via the '/video/:/transcode/universal' path parameter in Plex Media Server web logs.
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|contains: '/video/:/transcode/universal'
  selection_target:
    c-uri|contains:
      - '127.0.0.1'
      - 'localhost'
      - '192.168.'
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: all of selection*
level: high

Plex Media Server Spawning Suspicious Process

title: Plex Media Server Spawning Suspicious Process
id: 7e7f1b2c-3d4e-4f5a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects Plex Media Server.exe spawning known cryptominer executables or common shell interpreters, indicating potential post-exploitation activity after chaining vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith: '\\Plex Media Server.exe'
  selection_child:
    Image|endswith:
      - '\\xmrig.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\sh.exe'
  condition: all of selection*
level: critical

Mitigations

Immediately update Plex Media Server to version 1.43.3.10861 or later to patch CVE-2026-96655 and related vulnerabilities.
Implement network segmentation to restrict outbound connections from the Plex Media Server to only necessary services and destinations.
Enforce strong authentication policies for all Plex users, including multi-factor authentication where possible.
Regularly review Plex Media Server logs for suspicious activity and unexpected outbound connections.
Consider placing Plex Media Server behind a reverse proxy or Web Application Firewall (WAF) to filter malicious requests.

References

https://forums.plex.tv/t/plex-media-server/30447/711
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
https://www.cve.org/CVERecord?id=CVE-2026-96655
https://zmain.info/blog/plex2shell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type	Value	Description
SHA256	`2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db`	XMRig cryptominer payload (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441`	Cryptominer payload (docker) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7`	Cryptominer payload ‘x’ (UPX packed) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49`	Cryptominer payload ‘x’ (UPX unpacked) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9`	Proxy payload ‘myawesomeproxy’ (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`176.65.139.228`	Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`217.60.194.116`	Source IP for malicious file download (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`45.194.92.222`	Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`91.92.40.202`	Source IP of exploitation attempts (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`127.0.0.1.45-194-92-222.sslip.io`	Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`proxystream.st`	Domain related to proxy service traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
URL	`https://zmain.info/blog/plex2shell`	Vulnerability research blog detailing the chained exploit (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
malware_family	`XMRig`	Cryptominer malware deployed post-exploitation
malware_family	`myawesomeproxy`	Proxy malware deployed post-exploitation

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1090.003 — Multi-hop Proxy
T1496 — Resource Hijacking
T1059 — Command and Scripting Interpreter
T1583 — Acquire Infrastructure
T1133 — External Remote Services
T1204.002 — Malicious File
T1071 — Application Layer Protocol
T1090.002 — External Proxy
T1090 — Proxy
T1583.003 — Virtual Private Server
T1204 — User Execution
T1571 — Non-Standard Port
T1027 — Obfuscated Files or Information
T1486 — Data Encrypted for Impact
T1573 — Encrypted Channel
T1569 — System Services
T1027.002 — Software Packing
T1071.001 — Web Protocols
T1105 — Ingress Tool Transfer
T1090.001 — Internal Proxy

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,111 input / 2,003 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-96654: Plex Media Server URI Scheme Neutralization Vulnerability Exploited for Cryptomining

Posted on November 3, 2026 by Kyle

Overview

Plex Media Server is affected by CVE-2026-96654, a medium-severity vulnerability allowing attackers to manipulate URI schemes to call internal plugin functions. This flaw can be chained with other vulnerabilities to achieve remote code execution. Threat actors are actively exploiting this to deploy cryptomining malware, making immediate patching critical for affected organizations and users.

Technical Analysis

CVE-2026-96654: Improper Neutralization of Encoded URI Schemes in a Web Page.
Description: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in searchOne, allowing an attacker to call other plugins’ functions and supply their own parameters.
CVSS 3.1: 6.5 (Medium) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. This indicates network access, low attack complexity, no privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.
Weakness: CWE-84 (Improper Neutralization of Input During Web Page Generation).
Affected Versions: Plex Media Server versions prior to 1.43.0.10861.
Attack Vector: Network-based, unauthenticated. Exploitation involves crafting malicious URI requests to the Plex Media Server.
Chaining: This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656, potentially escalating impact to remote code execution.
Observed Impact: Active exploitation has been observed, leading to the deployment of cryptominer malware (e.g., XMRig) and proxy software (myawesomeproxy).

Detection

Monitor Plex Media Server process (Plex Media Server.exe) for unusual child process creation (e.g., cmd.exe, powershell.exe, wscript.exe, cscript.exe, or known cryptominer executables like xmrig.exe or myawesomeproxy.exe).
Inspect web server access logs for Plex Media Server for requests containing searchOne with unusual or encoded parameters, especially those attempting to invoke internal plugin functions.
Look for outbound network connections from the Plex Media Server process to known cryptomining pools or unusual IP addresses/ports.
Scan for the presence of known cryptominer executables (xmrig.exe) or proxy software (myawesomeproxy.exe) in unexpected directories, particularly within the Plex installation path or temporary directories.

Sigma Detection Rules

Plex Media Server Spawning Suspicious Child Process

title: Plex Media Server Spawning Suspicious Child Process
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes (e.g., cmd, powershell, cryptominers) spawned by Plex Media Server, indicating potential exploitation of CVE-2026-96654 or similar vulnerabilities.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: '\Plex Media Server.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\xmrig.exe'
      - '\myawesomeproxy.exe'
  condition: selection
level: high

XMRig Cryptominer Process Creation

title: XMRig Cryptominer Process Creation
id: 1f2e3d4c-5b6a-7f8e-9d0c-1b2a3f4e5d6c
status: experimental
description: Detects the creation of the XMRig cryptominer process, often deployed after successful exploitation of vulnerabilities like CVE-2026-96654.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    Image|endswith: '\xmrig.exe'
  condition: selection
level: high

Mitigations

Patch Immediately: Upgrade Plex Media Server to version 1.43.3.10861 or later. Refer to the official Plex release notes.
Network Segmentation: Isolate Plex Media Server instances from critical internal networks.
Restrict Outbound Connectivity: Implement firewall rules to limit outbound connections from the Plex Media Server to only necessary services, blocking access to known cryptomining pools.
Principle of Least Privilege: Ensure the Plex Media Server runs with the minimum necessary user permissions.
Regular Audits: Periodically review Plex Media Server logs and system activity for signs of compromise.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-96654
https://forums.plex.tv/t/plex-media-server/30447/711
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json
https://www.cve.org/CVERecord?id=CVE-2026-96654
https://zmain.info/blog/plex2shell
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

Indicators of Compromise

Type	Value	Description
SHA256	`2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db`	SHA256 hash of XMRig cryptominer (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441`	SHA256 hash of cryptominer docker file (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7`	SHA256 hash of UPX packed cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49`	SHA256 hash of UPX unpacked cryptominer executable (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
SHA256	`e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9`	SHA256 hash of ‘myawesomeproxy’ malware (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`176.65.139.228`	Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`217.60.194.116`	Source IP for malicious file download (cryptominer) (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`45.194.92.222`	Source IP for initial exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
IP Address	`91.92.40.202`	Source IP for exploitation attempt (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`127.0.0.1.45-194-92-222.sslip.io`	Dynamic DNS domain used in exploitation URI (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`proxystream.st`	Domain associated with ‘myawesomeproxy’ malware traffic (via https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
Domain	`sslip.io`	DNS service leveraged by attacker for owner token theft (via https://zmain.info/blog/plex2shell)
Email	`security@plex.tv`	Plex security contact email for vulnerability reporting (via https://zmain.info/blog/plex2shell)

MITRE ATT&CK

T1059.003 — Windows Command Shell
T1059.001 — PowerShell
T1496 — Resource Hijacking
T1583 — Acquire Infrastructure
T1133 — External Remote Services
T1204.002 — Malicious File
T1071 — Application Layer Protocol
T1190 — Exploit Public-Facing Application
T1090.002 — External Proxy
T1090 — Proxy
T1059 — Command and Scripting Interpreter
T1583.003 — Virtual Private Server
T1204 — User Execution
T1571 — Non-Standard Port
T1027 — Obfuscated Files or Information
T1486 — Data Encrypted for Impact
T1573 — Encrypted Channel
T1569 — System Services
T1027.002 — Software Packing
T1071.001 — Web Protocols
T1105 — Ingress Tool Transfer
T1090.001 — Internal Proxy

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,105 input / 1,684 output tokens ·

  Reviewed and approved by a human analyst before publication

Wireshark 4.6.9 Released: Multiple Vulnerabilities Addressed

Posted on September 28, 2026 by Kyle

Overview

Wireshark 4.6.9 has been released, addressing a total of 19 security vulnerabilities and 16 bugs. This update is critical for users running previous versions of the network protocol analyzer, as it resolves various issues that could potentially be exploited by malicious actors. The update ensures improved stability and security for network analysis operations.

Technical Analysis

The provided source material indicates that Wireshark version 4.6.9 fixes 19 vulnerabilities and 16 bugs. Specific Common Vulnerabilities and Exposures (CVE) identifiers, detailed descriptions of the vulnerabilities, affected components, or exploitation vectors were not detailed in the source. Without further information, it is not possible to provide a granular technical analysis of each individual flaw. Typically, Wireshark vulnerabilities can range from denial-of-service issues to arbitrary code execution, often triggered by processing specially crafted capture files or network traffic.

Detection

Detecting the exploitation of Wireshark vulnerabilities can be challenging as it often involves the compromise of the application itself on an analyst’s workstation. However, certain post-exploitation behaviors or application anomalies might be observable.

Application Crashes: Monitor for unexpected crashes of the wireshark.exe or tshark.exe processes.
Suspicious Process Spawns: Look for wireshark.exe or tshark.exe spawning unusual child processes, such as cmd.exe, powershell.exe, sh, or other scripting interpreters, which could indicate arbitrary code execution.
File System Modifications: Monitor for suspicious file writes or modifications in directories where Wireshark is installed or where capture files are processed, especially if not initiated by the user.
Network Anomalies: While less direct, an exploited Wireshark instance might initiate unexpected outbound network connections.

Sigma Detection Rules

Wireshark Suspicious Child Process Spawn

title: Wireshark Suspicious Child Process Spawn
id: 7c2e9f1a-b1c3-4d5e-a6f7-8e9d0c1b2a3f
status: experimental
description: Detects suspicious child processes spawned by Wireshark or TShark, which could indicate successful exploitation of a vulnerability leading to arbitrary code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\Wireshark.exe'
      - '\\tshark.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\sh.exe'
      - '\\bash.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
level: high

Mitigations

Patch Immediately: Update all Wireshark installations to version 4.6.9 or later. This is the primary and most effective mitigation.
Isolate Analysis Workstations: Conduct network analysis on dedicated, isolated workstations that are not used for general browsing or email. This limits the blast radius if a vulnerability is exploited.
Process Untrusted Files Safely: When analyzing capture files from untrusted sources, consider using a sandboxed environment or virtual machine to prevent potential compromise of the host system.
Least Privilege: Ensure that Wireshark is run with the minimum necessary privileges. Avoid running it as an administrator unless absolutely required for specific capture methods.
Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious process activity, file modifications, and network connections originating from Wireshark processes.

References

https://isc.sans.edu/diary/rss/33372

Indicators of Compromise

No public IOCs available at time of writing.

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,469 input / 1,050 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Posted on September 6, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-48710 affects Kludex Starlette, a lightweight ASGI framework, specifically versions prior to 1.0.1. The vulnerability stems from insufficient validation of the HTTP Host request header, allowing attackers to inject paths into the host part. This manipulation causes request.url.path to differ from the raw scope path, enabling authentication bypass in middleware or endpoints that rely on request.url for security decisions. This vulnerability can be chained with others, such as CVE-2026-42271.

Technical Analysis

Starlette versions before 1.0.1 do not adequately validate the HTTP Host request header before using it to reconstruct request.url. The routing algorithm, however, relies on the raw HTTP path (scope path). An attacker can craft a malformed Host header to prepend paths or inject other characters, causing request.url.path to diverge from the actual requested path.

Vulnerability Type: HTTP Request/Response Smuggling (CWE-444), Improper Input Validation (CWE-1289).
Affected Versions: encode starlette versions >= 0.8.3 and < 1.0.1. Various Red Hat products including ai_inference_server, ansible_automation_platform, migration_toolkit_for_applications, openshift_ai, openshift_lightspeed, and satellite are also affected.
Attack Vector: Network-based, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
Impact: Authentication bypass, potentially leading to unauthorized access to resources. Can be chained with other vulnerabilities for broader impact, including remote code execution or cryptomining as observed in community intelligence.
Prerequisites: The application must be using an affected version of Starlette, and security-sensitive middleware or endpoints must rely on request.url for access control decisions.
Resolution: Starlette version 1.0.1 and later validate the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and fall back to scope["server"] for malformed values.

Detection

Defenders can identify potential exploitation attempts by monitoring web server and application logs for anomalies related to the Host header.

Web Server Logs: Monitor Host header fields (e.g., cs-host, Host) for the presence of path separators (/, \) or their URL-encoded equivalents (%2f, %2F, %5c, %5C). These characters are invalid within the hostname part of a standard HTTP Host header.
Application Logs: Look for unexpected authentication bypasses, unauthorized access to restricted resources, or unusual requests to internal paths that do not align with expected user behavior, especially when correlated with suspicious Host headers.
WAF/API Gateway Logs: Review logs for requests flagged due to malformed Host headers or unusual URL structures that might indicate an attempt to exploit this vulnerability.

Sigma Detection Rules

Starlette CVE-2026-48710 Malformed Host Header Path Separator

title: Starlette CVE-2026-48710 Malformed Host Header Path Separator
id: 757d59b2-3e2a-4f5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-48710 by injecting path separators into the HTTP Host header, which can lead to request smuggling and authentication bypass in Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '/'
      - '\'
  condition: selection
level: high

Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path

title: Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects attempts to exploit CVE-2026-48710 using URL-encoded path separators in the HTTP Host header, indicative of request smuggling or authentication bypass attempts against Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '%2f'
      - '%2F'
      - '%5c'
      - '%5C'
  condition: selection
level: high

Mitigations

Prioritize patching and configuration changes to address this vulnerability.

Upgrade Starlette: Immediately upgrade Kludex Starlette to version 1.0.1 or greater. This version includes robust validation for the Host header.
Apply Vendor Patches: For affected Red Hat products, apply the latest security updates and patches provided by Red Hat.
Implement WAF/API Gateway Rules: Configure Web Application Firewalls (WAFs) or API gateways to strictly validate the Host header, blocking requests where the Host header contains path separators or other non-standard characters.
Review Application Logic: Ensure that security-sensitive middleware and application endpoints rely on the raw scope path for access control and routing decisions, rather than the potentially manipulated request.url.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48710
https://badhost.org
https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
https://www.secwest.net/starlette
https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
https://www.wiz.io/blog/ai-infrastructure-honeypot
https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
https://nvd.nist.gov/vuln/detail/CVE-2026-42271
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
https://ltna.com.au/cyber

Indicators of Compromise

Type	Value	Description
SHA256	`3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42`	LiteLLM — XMRig cryptominer binary (variant) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0`	LiteLLM — installer / bridge script (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f`	LiteLLM — XMRig cryptominer binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc`	LiteLLM #2 — unknown ELF binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`135.125.10.56`	RAGFlow exploitation C2 — LLM API key exfiltration endpoint (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`172.232.38.92`	Kestra reverse shell C2 (Linode VPS) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`194.213.18.133`	Attacker-controlled mail MX / mail infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`45.150.109.151`	Scanning/recon infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`47.86.197.116`	c3pool mining endpoint (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`45.150.109.151.sslip.io`	DNS rebinding used in LiteLLM attacks (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`auto.c3pool.org`	XMRig Monero mining pool (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`gobygo.net`	C2 beacon infrastructure — subdomain-encoded LiteLLM beacons (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.fun`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.me`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.pro`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`yosemite.jp`	C2/exfiltration endpoint — LiteLLM credential harvesting (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1078.004 — Cloud Accounts
T1071.004 — DNS
T1036.005 — Match Legitimate Resource Name or Location
T1082 — System Information Discovery
T1071 — Application Layer Protocol
T1036 — Masquerading
T1552 — Unsecured Credentials
T1055 — Process Injection
T1552.004 — Private Keys
T1059 — Command and Scripting Interpreter
T1083 — File and Directory Discovery
T1552.001 — Credentials In Files
T1059.004 — Unix Shell
T1078 — Valid Accounts
T1027 — Obfuscated Files or Information
T1059.006 — Python
T1496 — Resource Hijacking
T1518 — Software Discovery
T1105 — Ingress Tool Transfer

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,721 input / 2,018 output tokens ·

  Reviewed and approved by a human analyst before publication

WordPress Core SQL Injection (CVE-2026-60137) Chained for RCE

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.

Technical Analysis

The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.

Vulnerability Type: SQL Injection (CWE-89)
Affected Versions:
- WordPress >= 6.8, < 6.8.6
- WordPress >= 6.9, < 6.9.5
- WordPress >= 7.0, < 7.0.2
Prerequisites: A plugin or theme must pass untrusted input to the author__not_in parameter of WP_Query.
Attack Vector: Network (CVSS:3.1/AV:N)
Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with CVE-2026-63030, it leads to RCE.
CVSS 3.1 Score: 5.9 (MEDIUM)

Detection

Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing author__not_in= in the URI or POST body, especially when combined with common SQL injection payloads such as UNION SELECT, ' OR 1=1--, SLEEP(), or LOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests.
Process Monitoring: On web servers, monitor for the web server process (e.g., httpd.exe, nginx.exe, php-fpm.exe, w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe, powershell.exe, sh, bash) or scripting interpreters, which could indicate successful RCE.
File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new .php files in web-accessible directories (wp-content, wp-includes, plugin/theme directories), as this could indicate a webshell drop.
Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.

Sigma Detection Rules

WordPress Core SQL Injection CVE-2026-60137 Attempt

title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
  category: webserver
detection:
  selection_uri:
    - cs-uri-query|contains: 'author__not_in='
    - c-uri|contains: 'author__not_in='
  selection_sqli_patterns:
    - cs-uri-query|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
    - c-uri|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
  condition: selection_uri and selection_sqli_patterns
level: high

Web Server Process Spawning Suspicious Shell (Windows)

title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
level: critical

Web Server Process Creating Suspicious PHP File (Windows)

title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
  product: windows
  service: sysmon
  definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
  selection_process:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_file:
    TargetFilename|endswith: '.php'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-content\themes\'
      - '\html\'
      - '\www\'
  condition: selection_process and selection_file
level: high

Mitigations

Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the author__not_in parameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE.
Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with WP_Query or user-supplied input for author__not_in to ensure proper input sanitization and validation are in place.
Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-60137
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1505.003 — Web Shell
T1140 — Deobfuscate/Decode Files or Information
T1087 — Account Discovery
T1059 — Command and Scripting Interpreter
T1083 — File and Directory Discovery
T1552.001 — Credentials In Files
T1059.004 — Unix Shell
T1078 — Valid Accounts
T1068 — Exploitation for Privilege Escalation
T1027 — Obfuscated Files or Information
T1027.002 — Software Packing
T1071.001 — Web Protocols
T1136 — Create Account
T1018 — Remote System Discovery
T1046 — Network Service Discovery

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,343 input / 2,291 output tokens ·

  Reviewed and approved by a human analyst before publication

CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability

Posted on May 20, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-45498 is an unspecified denial of service (DoS) vulnerability affecting Microsoft Defender. Its inclusion in CISA’s KEV catalog highlights its potential for active exploitation or significant risk. Successful exploitation could disrupt the availability of Microsoft Defender on affected systems, potentially leaving endpoints unprotected.

Technical Analysis

The vulnerability allows for a denial of service condition within Microsoft Defender. Specific details regarding the underlying mechanism are currently unspecified. According to the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), exploitation requires local access to the system, has low attack complexity, does not require any privileges or user interaction, and results in a low impact to availability. No specific affected versions have been publicly detailed beyond ‘Microsoft Defender’ generally.

Detection

Detecting this specific DoS event without detailed technical information is challenging. Defenders should monitor for general indicators of Microsoft Defender instability or failure:
* Unexpected termination or restart of Microsoft Defender processes (e.g., MsMpEng.exe).
* High CPU or memory utilization by Microsoft Defender services that precedes system instability or crashes.
* Windows Event Log entries indicating service crashes (e.g., Event ID 7031, 7034 from Service Control Manager) or application errors (e.g., Event ID 1000 from Application Error) related to MsMpEng.exe or other Defender components.
* Alerts from Endpoint Detection and Response (EDR) solutions indicating unusual behavior or resource consumption by security software.

Mitigations

Apply all available security updates from Microsoft as soon as they are released. This is the primary mitigation for known vulnerabilities.
Ensure Microsoft Defender is configured for automatic updates of both the engine and definition files to receive the latest protections.
Implement robust endpoint detection and response (EDR) solutions to monitor for and alert on unusual process behavior or resource consumption that could indicate a DoS attack or system instability.
Regularly review system logs for errors or warnings related to Microsoft Defender services.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-45498
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498
https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,442 input / 742 output tokens ·

  Reviewed and approved by a human analyst before publication

Grafana GitHub Breach: Stolen Token Led to Codebase Theft

Posted on May 18, 2026 - September 27, 2026 by Kyle

Overview

Grafana Labs disclosed a security incident involving unauthorized access to its GitHub environment. A stolen GitHub access token allowed attackers to download private source code repositories. This event highlights the critical importance of securing developer credentials and monitoring access to source control systems.

Technical Analysis

Attackers gained unauthorized access to Grafana’s GitHub environment using a previously stolen GitHub access token. The specific method by which the token was initially compromised is not publicly detailed.
The stolen token provided sufficient permissions for the attackers to access and download private source code repositories.
Upon detection, Grafana Labs immediately revoked the compromised token.
The incident did not impact Grafana’s production environment, customer data, or hosted Grafana Cloud instances.

Detection

Monitor GitHub audit logs for unusual repo.download or repo.clone events, especially from unknown IP addresses, user agents, or by tokens with broad permissions.
Look for large data egress from source code management platforms that deviate from normal developer activity.
Implement alerts for access token usage from unexpected geographical locations or outside of typical working hours.
Review GitHub organization audit logs for oauth_application.access_token_created or oauth_application.access_token_deleted events that are not tied to known administrative actions.

Mitigations

Rotate GitHub Access Tokens: Regularly rotate all personal access tokens (PATs) and OAuth tokens, especially those with broad repository access.
Enforce Multi-Factor Authentication (MFA): Mandate MFA for all GitHub accounts, including service accounts, to prevent unauthorized access even if credentials are stolen.
Implement Least Privilege: Grant GitHub tokens and user accounts only the minimum necessary permissions required for their function. Avoid broad repo scopes.
Monitor GitHub Audit Logs: Implement continuous monitoring and alerting for suspicious activities such as unusual repository cloning, large data downloads, or token creation/deletion.
Review Connected OAuth Apps: Regularly audit and revoke access for any OAuth applications connected to GitHub accounts that are no longer needed or appear suspicious.

References

https://www.bleepingcomputer.com/news/security/grafana-says-stolen-github-token-let-hackers-steal-codebase/

Indicators of Compromise

No public IOCs available at time of writing.

Detection Rules (Sigma)

GitHub Unusual Repository Download

title: GitHub Unusual Repository Download
id: 921c1f71-a2c6-4d0f-a82f-2d7c5e4f1a3b
status: experimental
description: Detects suspicious repository download or clone activity in GitHub audit logs, potentially indicating unauthorized access or data exfiltration.
logsource:
  product: github
  service: audit
detection:
  selection_action:
    action|contains: ['repo.download', 'repo.clone']
  condition: selection_action
level: high

MITRE ATT&CK

T1078.003 — Local Accounts
T1020 — Automated Exfiltration

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  1,250 input / 855 output tokens ·

  Reviewed and approved by a human analyst before publication