Securexion Weekly Summary - 19 Oct 2026 to 25 Oct 2026
Last week brought four actively exploited vulnerabilities across infrastructure and media software, plus a critical PHP flaw affecting all supported versions. Immediate patching is essential for SiteGuard, Plex, and Siemens systems; PHP deployments need urgent attention.
Last week brought four actively exploited vulnerabilities across infrastructure and media software, plus a critical PHP flaw affecting all supported versions. Immediate patching is essential for SiteGuard, Plex, and Siemens systems; PHP deployments need urgent attention.
Top priorities this week
CVE-2026-87337: Oracle Access Manager authentication bypass allows unauthenticated compromise
CVSS 10.0 authentication bypass in Oracle Access Manager gives unauthenticated attackers complete platform control with scope change.
CVE-2026-109618 and 1 related: PHP remote code execution via use-after-free in memory management
Critical PHP use-after-free enables remote code execution on all supported versions (8.2–8.5) without authentication.
CVE-2026-106931: SiteGuard Server Edition OS command injection allows root/SYSTEM privilege escalation
Actively exploited OS command injection in SiteGuard allows low-privilege users to gain root/SYSTEM access on affected hosts.
CVE-2026-96656 and 3 related: Plex Media Server multiple critical flaws enable file write, SSRF, and cross-plugin attack
Four chained vulnerabilities in Plex Media Server (actively exploited) enable file writes, SSRF, and cross-plugin attacks by admins.
CVE-2026-110936: Siemens Software Center uncontrolled DLL load enables local privilege escalation
Actively exploited DLL search-path flaw in Siemens Software Center lets authenticated attackers escalate privileges via malicious libraries.
What we saw this week
- Local privilege escalation dominates: SiteGuard and Siemens both weaponize weak file/library handling to elevate from low/medium to root/SYSTEM.
- Multi-flaw chaining: Plex bundles four CVEs into a single attack chain; PHP's memory management issue affects request isolation across the platform.
- Active exploitation across the board: Four of five issues are live in the wild, signaling attacker readiness.
Your checklist for this week
- Prioritize SiteGuard Server Edition (2.20–8.00) and Plex Media Server (<1.43.3.10861) patches; both are actively exploited.
- Audit PHP deployments for versions 8.2–8.5; schedule immediate upgrades to patch use-after-free memory flaw.
- Verify Oracle Access Manager instances (12.2.1.4.0, 14.1.2.1.0) are isolated from untrusted networks pending patches.
- Update Siemens Software Center to 4.0.9.8+; audit DLL search paths on systems still running older versions.
- Review logs for SiteGuard, Plex, and PHP services for signs of command injection, file writes, or unusual SSRF traffic.
- Implement least-privilege principles for Plex admin accounts and local users on SiteGuard/Siemens systems to reduce attack surface.
Everything we covered
- CVE-2026-106931: SiteGuard Server Edition OS command injection allows root/SYSTEM privilege escalation (High, actively exploited)
- CVE-2026-96656 and 3 related: Plex Media Server multiple critical flaws enable file write, SSRF, and cross-plugin attack (High, actively exploited)
- CVE-2026-110936: Siemens Software Center uncontrolled DLL load enables local privilege escalation (High, actively exploited)
- CVE-2026-87337: Oracle Access Manager authentication bypass allows unauthenticated compromise (Critical)
- CVE-2026-106931: SiteGuard Server Edition OS Command Injection Allows Root Compromise (High, actively exploited)
- CVE-2026-96656 and 3 related: Plex Media Server Multiple Critical Flaws Enable Remote Exploitation and Arbitrary Code Execution (High, actively exploited)
- CVE-2026-110936: Siemens Software Center DLL Search Path Flaw Allows Local Privilege Escalation (High, actively exploited)
- CVE-2026-109618 and 1 related: PHP remote code execution via use-after-free in memory management (Critical)
Securexion is published by FutureOps InfoTech. Need help working through this list? Talk to us.