Securexion Daily Exploit Watch - 25 Oct 2026
PHP object injection in Prime Mover WordPress plugin allows unauthenticated attackers to execute code when admins perform routine backups; update immediately.
Latest
CVE-2026-115806: Prime Mover WordPress Plugin – Unauthenticated Remote Code Execution via Object Injection
The Prime Mover backup and migration plugin for WordPress contains an unsafe deserialization flaw in its search-and-replace routine that accepts untrusted, base64-encoded serialized objects from comment fields. An attacker can inject a malicious object that exploits a Property-Oriented Pro
Securexion Daily Exploit Watch - 24 Oct 2026
Two actively exploited flaws demand immediate attention: Arista VeloCloud Orchestrator SQL injection (CVSS 9.9) and Collabora Online CODE Server command injection (CVSS 9.2). Patch or isolate these systems now.
CVE-2026-109618: PHP Use-After-Free in Memory Allocation Leads to Remote Code Execution
Multiple PHP versions contain a use-after-free vulnerability triggered by out-of-memory errors that leave request memory uninitialized, enabling remote code execution. This flaw affects PHP 7.3, 8.2, 8.3, 8.4, and 8.5 across all deployments.
CVE-2026-110447: Collabora Online CODE Server Command Injection Enables Remote Code Execution
Collabora Online Built-in CODE Server before version 26.4.303 is vulnerable to OS command injection in proxy.php when the CODE server is not running, allowing unauthenticated remote code execution. This flaw is actively exploited in production environments.
CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Allows Privilege Escalation
An authenticated user can exploit SQL injection in VeloCloud Orchestrator to gain operator-level privileges and access internal functionality. This flaw is actively exploited and affects on-premises deployments across multiple versions.
Securexion Weekly Summary - 19 Oct 2026 to 25 Oct 2026
Last week brought four actively exploited vulnerabilities across infrastructure and media software, plus a critical PHP flaw affecting all supported versions. Immediate patching is essential for SiteGuard, Plex, and Siemens systems; PHP deployments need urgent attention.
CVE-2026-106931: SiteGuard Server Edition OS command injection allows root/SYSTEM privilege escalation
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection vulnerability (CWE-78) exploitable by local users with low privileges. Attackers can execute arbitrary commands with root or SYSTEM level access, fully compromising the host system.
CVE-2026-96656 and 3 related: Plex Media Server multiple critical flaws enable file write, SSRF, and cross-plugin attack
Plex Media Server before version 1.43.3.10861 contains four distinct actively exploited vulnerabilities including arbitrary file write (CWE-73), server-side request forgery via two endpoints (CWE-918), and URL-scheme mishandling (CWE-84). Together, these allow admin users to achieve code e
CVE-2026-110936: Siemens Software Center uncontrolled DLL load enables local privilege escalation
Siemens Software Center before version 4.0.9.8 searches for dynamic-link libraries (DLLs) in uncontrolled paths, allowing an authenticated local attacker to plant a malicious DLL and achieve code execution with the application's privileges. This is actively exploited.
CVE-2026-87337: Oracle Access Manager authentication bypass allows unauthenticated compromise
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an easily exploitable vulnerability in the Authentication Engine component that allows unauthenticated network attackers to gain full control. This is a CVSS 10.0 flaw with scope change affecting the entire platform.
Securexion Daily Exploit Watch - 23 Oct 2026
Five actively exploited flaws demand immediate action: OS command injection in SiteGuard Server Edition, multiple critical vulnerabilities in Plex Media Server, uncontrolled DLL loading in Siemens Software Center, and authentication bypass in Oracle Access Manager.
Vulnerability
CVE-2026-106931: SiteGuard Server Edition OS Command Injection Allows Root Compromise
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection flaw that allows a local attacker with low privileges to execute arbitrary commands as root or SYSTEM. This is actively exploited and requires immediate patching per CISA BOD 26-04 guidance.
Vulnerability
CVE-2026-96656 and 3 related: Plex Media Server Multiple Critical Flaws Enable Remote Exploitation and Arbitrary Code Execution
Plex Media Server before version 1.43.3.10861 contains four actively exploited vulnerabilities including arbitrary file execution, SSRF, URL manipulation, and plugin parameter injection. Together these flaws allow remote attackers to compromise the server and internal networks.
Vulnerability
CVE-2026-110936: Siemens Software Center DLL Search Path Flaw Allows Local Privilege Escalation
Siemens Software Center versions before 4.0.9.8 load dynamic libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to place a malicious DLL and achieve code execution. This is actively exploited.
Daily Brief
Securexion Daily Exploit Watch - 23 Oct 2026
Five actively exploited vulnerabilities demand immediate attention: SiteGuard OS command injection, four Plex Media Server flaws, and Siemens Software Center privilege escalation. Patch or isolate affected systems now.
Daily Brief
Securexion Daily Exploit Watch - 22 Oct 2026
Critical PHP memory safety flaws in all supported versions (8.2–8.5) allow unauthenticated remote code execution via out-of-memory and global state corruption. Patch immediately.
Vulnerability
CVE-2026-109618 and 1 related: PHP remote code execution via use-after-free in memory management
Two critical vulnerabilities in PHP's out-of-memory handling and global state management leave freed request memory accessible to subsequent requests, allowing remote code execution without authentication or user interaction. All supported PHP versions 8.2 through 8.5 are affected.