🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560 The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. ⠀ PHP says exploitation requires an unusual configuration where an application: • Uses php_binary or php_serialize as its session serializer • Changes the serializer to php at runtime before session_start() • Has session upload progress enabled ⠀ PHP considers the risk unlikely and plans to release a fix during its next regular update cycle. Until then, administrators with affected configurations should set: session.upload_progress.enabled=0 Applications that do not change the session serializer at runtime are not exposed through this path. No exploitation has been reported. Source: php.net/

🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers PoC: github.com/code-zm/plex2shel… A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities: • CVE-2026-96652 • CVE-2026-96654 • CVE-2026-96655 • CVE-2026-96656 ⠀ The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations. ⠀ Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections. ⠀ Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing: • myawesomeproxy • mylovelyminer • x12345 • --rig-id • --donate-level • proxystream[.]st ⠀ Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes. ⠀ The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.