🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers PoC: github.com/code-zm/plex2shel… A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities: • CVE-2026-96652 • CVE-2026-96654 • CVE-2026-96655 • CVE-2026-96656 ⠀ The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations. ⠀ Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections. ⠀ Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing: • myawesomeproxy • mylovelyminer • x12345 • --rig-id • --donate-level • proxystream[.]st ⠀ Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes. ⠀ The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate

🔥Introducing OWASP Projects Hot Takes! It’s Cybersecurity Awareness Month, and throughout October, we’ll be sharing top tips from our OWASP project teams to help you build more secure software. 👀 🔥 First up: Network Security, from OWASP CRS! Your perimeter firewall lets HTTP traffic through by design. That’s where attacks can get in. OWASP CRS provides a free, community-maintained set of rules for WAFs like ModSecurity and Coraza, helping block common attack patterns covered by the OWASP Top 10 at the edge of your network. #OWASP #CybersecurityAwarenessMonth #AppSec #NetworkSecurity

🍯🍯🍯🍯

🚨 Our Redis decoys recorded repeated scripted attempts to exploit CVE-2026-25243, a heap memory-corruption bug in Redis’s RESTORE command, overnight Oct 16-17. No prior public report exists of this CVE being attempted in the wild. One source hit the decoy five times on a timer with a identical payload: fingerprint the server, shape the heap with 26 key writes, fire a single malformed-zipmap RESTORE that triggers the documented over-read, run a throwaway Lua compute probe, then FLUSHALL the keyspace, destroying data and its own artifacts every run. Note that the bug needs command access to be exploitable. Full IOCs on Defused Radar 👉 console.defusedcyber.com/sig…

We've got some of the smartest, kindest folks in CVD working on community-submitted vulnerabilities — if you're a researcher and you'd like someone to coordinate a vulnerability disclosure for you, submit here: vulncheck.com/advisories/rep…

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

Do a kickflip!

Danfoss refrigeration incidents: We are sharing exposed instances for a long time in our Device ID reporting, daily. For Danfoss AK-SM800A we still see at least 365 unique instances daily (drop from over 550 last few days) exposed. These need to be taken off the public Internet!

Had the pleasure of supporting the Global OSINT Conference (@OSINT_Community) last week. A brilliant day of ideas, insight and conversation. Thank you to the sponsors, speakers and everyone who came along! Some photos below:

Next week I'll be in Toronto, Canada 🇨🇦 to speak at Black Hat SecTor 2026 (Oct 6–8, Metro Toronto Convention Centre). If you're in town, let's connect! 🤝 #SecTor #BlackHat #Cybersecurity #InfoSec #Toronto

Cisco Catalyst SD-WAN Manager API Authentication Bypass (CVE-2026-76504) advisory has just been released, including IoCs. POST /%6a_security_check 🤯 Added to @PrevidianCyber KEV catalog. Honeypots up and monitors in place.

We've started on Nuclei v4. What should it do that v3 can't? Replies here, or open an issue: github.com/projectdiscovery/…

CVE-2026-88771: Detection Artifact Generator for Citrix NetScaler GitHub: github.com/watchtowrlabs/wat…

thank you to all of our 1337 contributors 🤍

🍯🍯🍯

🎉 Today marks 25 years of OWASP 🎉 OWASP isn’t just projects, events, tools, or chapters. It’s the people who show up and make this community what it is. So we asked our community: What does OWASP mean to you? Their answers say it better than we ever could. A huge thank you to everyone who has been part of the mission so far. Happy 25th Anniversary, OWASP. Here’s to everything still to come. 💛 #OWASP25 #OWASP #AppSec #OpenSource

I found a command injection vulnerability in BasicSR (CVE-2024-27763) caused by the unsafe handling of SLURM_NODELIST. I wrote up the details and PoC: aydinnyunus.github.io/2026/0… #security #websecurity #appsec #bugbounty

‼️ Attackers are exploiting a critical Issabel Framework flaw. CVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available. How the flaw works: thehackernews.com/2026/09/at…

now featured on @TheHackersNews 🥳 thehackernews.com/2026/09/at…