Plex Media Server exploited in the wild (Plex2Shell)

Attackers began exploiting Plex Media Server vulnerabilities on October 17, one day after researcher Zach Main published a full write-up and proof-of-concept for his "Plex2Shell" chain. The chain links four CVEs (CVE-2026-96652, -96654, -96655, -96656) into unauthenticated remote code execution, and a honeypot caught attackers dropping a cryptominer and a proxy tool. Update to 1.43.3.10861 or later and avoid exposing port 32400 directly to the internet.

Source: https://securityonline.info/plex2shell-plex-media-server-exploited/

Microsoft's record October Patch Tuesday

Microsoft's October 2026 Patch Tuesday (October 13) fixed a record-breaking set of vulnerabilities — counts vary by source from roughly 1,411 to 1,413 — including 70 or more rated critical and three zero-days. One exploited in the wild was CVE-2026-96951, a Windows Shell flaw that bypasses the "Mark of the Web" protection. It's worth patching that zero-day first, and noting that Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 received their final update on this release.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-october-2026-patch-tuesday-fixes-1-411-flaws-3-zero-days/

curl 8.23.0 ships with 24 fixes

The curl project released version 8.23.0 on October 14, fixing twenty-four vulnerabilities. The most severe is CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads that could be converted into remote code execution under a specific set of conditions with a malicious server. Because libcurl is embedded in many applications and not always advertised, upgrading to 8.23.0 (or the fixed branch releases) is the recommended action.

Source: https://curl.se/docs/CVE-2026-92392.html

16-year-old Broadcom Wi-Fi flaw disclosed

Security researcher Quentin Kaiser, presenting at Hexacon on October 16, documented an unauthenticated remote-code-execution flaw in Broadcom's proprietary 802.11/WPS EAP implementation that has been in its SDK since at least 2010. An attacker within Wi-Fi range can gain code execution on affected routers without knowing the network password, and on eCos-based platforms the bug is effectively a permanent "forever day." Worth checking whether your router or access-point vendor has shipped a fix.

Source: https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/

CISA flags Ignition privilege-escalation flaw

A CISA ICS advisory (ICSA-26-286-01) describes CVE-2026-92817, an incorrect-authorization vulnerability in Inductive Automation Ignition that lets an authenticated low-level user escalate privileges. No public exploitation specific to this flaw had been reported at publication, but it's a vulnerability worth addressing in industrial and OT environments. If you run Ignition, review the advisory and apply the vendor guidance.

Source: https://securityboulevard.com/2026/10/daily-ot-security-news-october-18-2026/