Security Monitor 2026-10-20

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

CISA added six exploited flaws to its KEV catalog on October 20th, and three of them have a federal deadline of this Friday, October 23rd. The biggest is Plex2Shell: four Plex Media Server bugs that chain an API request carrying a junk token into code execution, and Plex says attackers are now "actively and widely" exploiting unpatched servers to run cryptominers and residential proxies. The other short clock is SiteGuard Server Edition, a host-based web application firewall whose default-on statistics feature runs attacker commands as root or SYSTEM. Separately, someone held the private keys for eight eMudhra intermediate certificate authorities. Chrome and Firefox blocked them within hours, but Go, Python certifi and other non-browser TLS clients only stop trusting them when you rebuild or update, and Node.js has merged a fix but hasn't shipped it in a release yet. Also today: 13 new CVEs against nine self-hosted AI agent frameworks, most of them with no fixed version; an API vendor breach that exposed customers' stored cloud storage keys and API logs; and Microsoft's push to treat AI agents as insiders.

Headline Developments

1. Plex2Shell: four chained Plex Media Server API bugs are on KEV, widely exploited, and two are due Friday CRITICAL

Source: Plex Forums: Important Security Update for Plex Media Server v1.43.2 and earlier (updated October 19th)
- CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on October 20th. CVE-2026-96654 and CVE-2026-96656 are due October 23rd; the two SSRF bugs, CVE-2026-96652 and CVE-2026-96655, are due November 3rd (CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog). All four affect Plex Media Server before 1.43.3.10861. Plex told owners to update to 1.43.3 on September 1st without listing the flaws, and published the CVE details on October 19th.
- Researcher Zach Main's write-up shows how the chain works. The /player/timeline endpoint only checks that an X-Plex-Token header exists, not that it's valid, so a junk token makes the server send a request to itself. From loopback, the plugin API needs no token, and an injected identifier lets the attacker call a metadata plugin that fetches any URL. The plugin framework attaches the owner's admin token to any outbound URL that starts with the loopback address, and the check is a plain prefix match, so a hostname like 127.0.0.1.<attacker>.sslip.io gets the token sent to the attacker. With the owner token, a transcoder preference writes an attacker-built shared object into the Codecs folder, and Plex loads it on the next transcode (zmain: Plex2Shell, October 16th). Main says he found it with heavy LLM help over hours of guided work.
- A honeypot run by the researcher behind BoredHackerBlog saw in-the-wild exploitation on October 17th, the day after the proof of concept went public, first dropping an XMRig-based miner and later proxy software (BoredHackerBlog: Plex vulnerabilities being exploited in the wild to drop a cryptominer, October 17th).
- Plex's October 19th update says servers older than 1.43.3.10861 that are reachable from the internet should be assumed compromised. It lists process names like myawesomeproxy, mylovelyminer and x12345, unfamiliar .so or .dll files in the Codecs folder, and outbound connections to proxystream.st as signs to check.

Why this matters: It's CRITICAL because it's KEV-listed, widely exploited and has had a fix since at least September 1st. Each bug scores low to medium on its own (NVD lists 4.3 to 7.2 under CVSS 3.1), which is exactly why it sat unpatched. The real flaw is an API that trusted where a request came from and whether a token header was present, rather than who sent it. Plex often runs on home and small-office machines next to file shares and saved credentials, and the residential proxy payload turns that connection into cover for someone else's traffic.

Pattern callout: Same shape as the agent servers covered October 19th: trust granted by network location or a header's presence, not by a verified identity.

2. Eight eMudhra CA keys were compromised: browsers are covered, your Go, Python and Node services may not be HIGH

Source: Mozilla Security Blog: Protecting Firefox users following the compromise of eMudhra intermediate certificates (October 20th)
- Mozilla says it got a report at 20:06 UTC on October 17th that private keys for eight eMudhra intermediate certificates were compromised. Those keys could issue HTTPS certificates for sites the holder doesn't control. Firefox users with standard settings got a OneCRL block in under three hours. Firefox 158.0.1 and ESR 115.43.1 and 153.5.1 carry the block for installs that can't receive it (CVE-2026-113470, NVD: CVE-2026-113470), and NSS 3.131.1 removes the root that signed them.
- The Hacker News reported that the Chrome Root Program blocked the six TLS intermediates by CRLSet within two hours, found no Certificate Transparency-logged certificate chaining to them before the block, and will remove the same root. It's still unknown how the keys left eMudhra, when, or whether anyone other than the reporting researcher holds them (The Hacker News: Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software, October 20th).
- Non-browser clients are the gap. Go 1.27.3 and 1.26.10 filter out any chain containing the eight intermediates, and programs only get that after they're rebuilt; Go calls it "a specific Certificate Authority" without naming it (Go announcement: Go 1.27.3 and Go 1.26.10 are released, October 20th). The Hacker News lists Python certifi 2026.10.19 and Rust webpki-roots 1.0.10 as dropping the root. Composer's CA bundle followed later on October 20th with 1.6.0 and 1.4.16, which distrust the compromised intermediates (GitHub: composer/ca-bundle 1.6.0 release). Node.js merged a change the same day that rejects chains containing the eight keys, but it isn't in a release yet (GitHub: nodejs/node pull request 66871, tls: reject chains containing blocked public keys). Node.js has security releases scheduled for October 21st, and its announcement doesn't say whether this change is in them (Node.js: Wednesday, October 21, 2026 Security Releases). Removing the root also breaks legitimate sites that chain to it.
- A public page published by Mozilla engineer Dennis Jackson lists the eight certificates and messages signed with each key (eMudhra Intermediate CA Compromise).

Why this matters: It's HIGH because most API traffic doesn't come from a browser. Backend services, SDKs, webhooks and agents calling tools use their language's TLS stack and a bundled root list, and they rarely check revocation. That leaves a window where a forged certificate could intercept API calls and the bearer tokens inside them. No misuse has been reported.

3. Thirteen more CVEs against nine self-hosted AI agent frameworks, and most have no fix HIGH

Source: Severity Daily: Thirteen AI agent framework records published in ten seconds, and in most of them the shipped default is the vulnerability (October 20th)
- NVD published 13 VulnCheck-assigned records on October 20th covering nine agent projects, all credited to Lasso Security researchers. It's the rest of the batch that produced the Cognition CVE covered October 19th. Lasso's entries list no known exploit, and none is on KEV.
- Unauthenticated, CVSS 3.1 9.8: Langchain-Chatchat through 0.3.1.3 runs any registered tool by name from POST /tools/call, including the always-registered shell tool (NVD: CVE-2026-75128). DB-GPT through 0.8.2 uses a mock auth function that makes every caller an admin on its ReAct agent endpoint (NVD: CVE-2026-77932), and its compose file ships a static MySQL root password on a published port (CVE-2026-77933). piflow 2.0.0 through 2.0.1 has no auth on POST /chat and an exec_shell tool with no approval (CVE-2026-109442, VulnCheck: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell). Letta through 0.16.8 ships with its password middleware off and a default-credential PostgreSQL port (CVE-2026-77936), and a self-asserted user_id header lets callers act as other tenants even with security on (CVE-2026-77937) (NVD: CVE-2026-77936).
- Via planted content, no login needed: OpenSRE through 0.1.2026.10.19 has an approval check that always returns true, so instructions injected into alerts or Slack messages it triages run shell_run commands (NVD: CVE-2026-109444). LangAlpha through 2026.09.07 (CVE-2026-109440) and EvoScientist before 0.2.5 (CVE-2026-77930) run shell or code planted in web content they fetch.
- Logged-in users reach the host: Coze Studio before 0.5.0 (CVE-2026-77934, unsandboxed code nodes), JoySafeter through 1.0.0 (CVE-2026-109443, self-registration plus a shell tool) and Aix-DB 1.2.4 (CVE-2026-77926). Coze Studio through 0.5.1 also lets users read and run other tenants' workflows by ID (CVE-2026-77935).
- Only Coze Studio 0.5.0 (for the code runner) and EvoScientist 0.2.5 list a fix. Severity Daily notes that for DB-GPT and Langchain-Chatchat, the affected range ends at the latest release on PyPI.

Why this matters: It's HIGH because these frameworks hold the model keys, data source passwords and cloud tokens, and the shell tool is the product. When there's no version to move to, network reachability is the only control you have. OpenSRE shows that even an internal-only agent is reachable through whatever it reads.

Pattern callout: Extends the Cognition and Google SAM story (October 19th). New today: nine more projects, and the fix rate is two in nine.

4. SiteGuard WAF and Siemens Software Center join KEV, with SiteGuard due Friday HIGH

Source: JPCERT/CC: Alert on SiteGuard Server Edition OS command injection (CVE-2026-106931), in Japanese (October 14th)
- CVE-2026-106931: an OS command injection in the statistics feature of SiteGuard Server Edition, a host-based web application firewall from EG Secure Solutions, runs commands as root or SYSTEM (NVD: CVE-2026-106931). The vendor says abuse is confirmed. Versions 2.20 and later before 8.00 Update 5 are affected (before 7.00 Update 6 on FreeBSD); IIS 3.10 through 4.00 Update 4 aren't (EG Secure Solutions: SiteGuard alert, in Japanese).
- The vendor warns that patching may erase attack traces and asks admins to download the Diagnostic information bundle first. There's a file-replacement patch for installs that can't upgrade, including end-of-life versions, and JPCERT/CC says turning off the statistics feature avoids the bug (BleepingComputer: Hackers exploit SiteGuard WAF flaw to run commands as admins, October 18th). CISA's federal deadline is October 23rd.
- CVE-2026-110936: Siemens Software Center before V4.0.9.8 loads DLLs from an uncontrolled search path, so a local attacker can get code to run as the app. Siemens says it's being actively exploited; the KEV deadline is November 3rd (Siemens ProductCERT: Active exploitation of CVE-2026-110936 in Siemens Software Center).

Why this matters: It's HIGH because the WAF sits in front of the web apps and APIs it's meant to protect, with root on the same host. If you run SiteGuard, keep the evidence first, then patch.

5. Attackers landed where the API keys were: APITemplate.io's template RCE and a backdoored OVHcloud CLI MEDIUM

Source: APITemplate.io: October 2026 security incident (October 19th, updated October 20th)
- APITemplate.io, a document-generation API, says an unauthorized party used crafted templates to run code on its rendering servers between October 12th and 16th. They got the storage credentials customers saved in "post actions" for Amazon S3, Cloudflare R2, other S3-compatible services and Azure, including inactive ones, plus API logs from a limited period that contained API keys, request data and document links. A few passwords were captured as users signed in.
- The company fixed the bug on October 16th and has stopped logging credentials and request data. It's asking customers to revoke any storage key saved in a post action today, check storage provider logs from October 12th on, and replace it with an upload-only credential. It says it found no use of exposed API keys after October 16th.
- OVHcloud CEO Octave Klaba said an attacker used a hijacked developer GitHub account to replace OVHcloud CLI releases 0.11.0 through 0.15.0 with locally built binaries that read secrets from disk. The bad releases were live for about 90 minutes on October 19th, and GitHub's release immutability setting was off. OpenSourceMalware links the activity to the GlassWorm campaign (BleepingComputer: OVHcloud CLI releases backdoored on GitHub to steal developer secrets, October 20th). Versions 0.10.0 and 0.16.0, source builds and Docker images are clean.

Why this matters: It's MEDIUM because both are contained, but the lesson is the same. A third-party API holding your full-access storage key, or a CLI on a laptop full of tokens, makes one bug everyone's incident. Hand vendors the narrowest key that works, and keep request logs free of credentials.

6. Microsoft wants AI agents treated as insiders, with permissions granted per task CONTEXT

Source: Microsoft Security Blog: Agents are your newest insiders. Security must move at their speed. (October 19th)
- Microsoft announced Dynamic Permissions, where an agent starts with no access and gets task-scoped, time-limited authority that can't exceed its user's; Dynamic Agent Risk, a continuously updated risk score; and Dynamic Conditional Access, which can drop an agent to read-only, require human approval or stop it as risk rises. It's also adding Guardian Agents to Project Perception and expanding discovery to 60 local agent types, including Claude Code, OpenAI Codex and GitHub Copilot.
- The post's core rule is that the model can't be its own security boundary: controls have to sit outside it. Microsoft didn't give availability dates in the post (SecurityWeek: Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring, October 20th).

Why this matters: It's CONTEXT, but it's the right design, and you don't need the product to start. Give each agent its own identity, start it with nothing, and put approval in front of high-impact actions. Story 3's always-true approval check is what happens when that layer lives inside the agent.

Continuity Footnotes

Cairn AI-agent intrusion campaign: covered October 19th. SecurityWeek, citing NorForge, describes two more clusters beyond the main one: an English-speaking group across 10 exposed panels going after card and cryptocurrency theft on payment and pharmacy sites, and a third panel with 59 projects aimed at large US e-commerce platforms (SecurityWeek: AI Platform Cairn Abused to Hack Over 100 Organizations, October 20th).
opencode MCP OAuth RCE: covered October 19th. Infosecurity Magazine reports Pillar Security said Anomaly told it malicious MCP servers are "outside their threat model" before quietly fixing it in 1.18.33 (Infosecurity Magazine: Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, October 20th).
ConnectWise Cloud Backup (SkyKick) credential abuse: covered October 17th. ConnectWise's latest update (8:30 PM ET on October 20th) says it finished resetting every account and credential in the affected environment on October 19th and is still validating that work before a phased restore, which it expects to take several days once it starts. It's also running technical webinars every two hours to walk partners through reviewing their Microsoft 365 tenants. Cloud Backup, SaaS Security and Cloud Management stay suspended; keep the app connections disabled until ConnectWise says otherwise (ConnectWise Trust Center: Cloud Backup Service Interruption).

Pattern Analysis

Trust by location instead of identity (October 19th to 20th): Plex trusted loopback and a token header's existence (Story 1), DB-GPT handed every caller admin (Story 3), and the agent servers covered October 19th shipped with no login. The fix is always the same: verify who's calling, every time.
Short KEV clocks on old fixes (October 20th): Plex told owners to update on September 1st and SiteGuard notified directly supported customers on September 29th, yet both now carry Friday deadlines. Low per-bug scores (Plex) and quiet fixes delay patching until a proof of concept lands.
The trust anchor is the weak point for non-browser clients (October 20th): browsers got the eMudhra block in hours; server-side TLS stacks need a rebuild (Story 2). API clients inherit whatever root list they shipped with.
Credentials pile up where tools run (October 17th to 20th): ConnectWise's app credential, APITemplate.io's stored storage keys, OVHcloud CLI users' disks and agent framework environments. Narrow, short-lived keys limit the blast radius.

Recommended Actions

Immediate (this week):
1. Plex Media Server (KEV, due October 23rd): upgrade to 1.43.3.10861 or later. If an older server was reachable from the internet, check for Plex's listed process names, unknown .so / .dll files in Codecs and outbound proxy traffic; if in doubt, rebuild clean, sign out all devices and change the Plex password. Turn off Remote Access if you don't need it.
2. SiteGuard Server Edition (KEV, due October 23rd): download Diagnostic information first, then update to 8.00 Update 5 (7.00 Update 6 on FreeBSD) or apply the file patch. Disable statistics if you can't patch yet.
3. eMudhra certificates: rebuild Go services with 1.27.3 or 1.26.10, update certifi to 2026.10.19, webpki-roots to 1.0.10 and Composer's ca-bundle to 1.6.0 or 1.4.16, and update NSS-based trust stores. For Node.js, block the eight intermediates or the emSign roots in your own CA config until a release with the fix lands, and check the October 21st release notes. Check whether any of your own endpoints chain to emSign roots before the removal breaks them.
4. APITemplate.io customers: revoke any storage key saved in a post action, review storage logs from October 12th, issue an upload-only replacement and rotate API keys you were told about.
5. OVHcloud CLI: if you downloaded 0.11.0 through 0.15.0, remove it, install 0.16.0 and rotate every secret on that machine.

This month:
6. Self-hosted agent frameworks: inventory by deployment, not package manifest, since most are stood up from a compose file. Put Langchain-Chatchat, DB-GPT, piflow, Letta, Aix-DB, JoySafeter, OpenSRE and LangAlpha behind authentication you control, change bundled database passwords and unpublish their ports. Upgrade Coze Studio to 0.5.0 and EvoScientist to 0.2.5.
7. Siemens Software Center: upgrade to V4.0.9.8 or later (KEV, due November 3rd).
8. Release integrity: turn on GitHub release immutability for projects you ship, and pin downloads to checksums or signed artifacts.

Ongoing:
9. Test that approval gates in front of agent shell and code tools actually block something, and give each agent its own identity with task-scoped permissions.
10. Don't rely on a vendor-side score to schedule patching: re-rank whenever a public proof of concept or a KEV listing appears.

Relevant Risk Summary

Risk	Severity	Recommended Actions
Plex2Shell CVE-2026-96652 / 96654 / 96655 / 96656 (KEV, widely exploited)	CRITICAL	1.43.3.10861+; hunt Codecs folder and processes; disable Remote Access
eMudhra intermediate CA key compromise (CVE-2026-113470 for Firefox)	HIGH	Rebuild Go; update certifi, webpki-roots, Composer ca-bundle and NSS; block keys for Node.js until it ships a fix
13 agent framework CVEs (Langchain-Chatchat, DB-GPT, piflow, Letta, OpenSRE and more)	HIGH	Network isolation and auth proxy; change default DB creds; Coze 0.5.0, EvoScientist 0.2.5
SiteGuard CVE-2026-106931 (KEV); Siemens Software Center CVE-2026-110936 (KEV)	HIGH	Save diagnostics, then patch; V4.0.9.8
APITemplate.io breach; OVHcloud CLI backdoor	MEDIUM	Revoke stored storage keys; rotate secrets on affected machines
Agents as insiders (Microsoft)	CONTEXT	Per-agent identity; task-scoped access; approval outside the model

Sources

Informational security guidance. Not certification.