Weekly Security Bulletin #2: BeyondTrust and Plex under active exploitation, a code execution flaw in Next.js
· Security
This issue covers October 14 to 24, 2026. The sources are the same: the Red Hat CVE database, CVE.org, OpenCVE and the GitHub Advisory Database. Whether a flaw is really being exploited comes from the CISA KEV list. What happened to the flaws from earlier posts has its own section below.
In short
- CVE-2026-102764 in BeyondTrust Remote Support (CVSS 4.0: 9.3) entered CISA KEV on Oct 16. Press reports say exploitation began 47 days before disclosure. If you run it on your own servers, apply the BT26-05-RS fix.
- The four Plex Media Server flaws (“Plex2Shell”) were added to KEV on Oct 20. Version 1.43.3.10861 and later are not affected.
- Next.js 16.0.0 through 16.4.0 has an unauthenticated remote code execution flaw in apps that use use cache. The fix is 16.4.1 and there is no workaround.
- Critical fixes shipped for Laravel (13.29.0 and 12.68.0), Pillow (13.0.0), Wasmtime (36.0.19 and 43.0.0) and DOMPurify (3.4.17).
- Red Hat published 1,225 records from Oct 14 to 23. Six are rated “critical” and 298 “important”.
- 1,225 · New Red Hat CVE records · Oct 14-23
- 15 · New KEV entries · Oct 14-23, including Oct 14
- 6 · “Critical” Red Hat records · 298 important, 747 moderate, 174 low
- 47 · Days · between first BeyondTrust exploitation and disclosure
- 4 · Plex flaws · added to KEV on the same day, Oct 20
Urgent first
BeyondTrust Remote Support: CVE-2026-102764
Internal messaging components validate the request origin poorly. An unauthenticated attacker can perform file operations and upload arbitrary files (CVSS 4.0: 9.3). CISA added it to KEV on Oct 16. For self-hosted installs the BT26-05-RS fix covers versions 24.3.1 through 26.2.3; older releases must first move to a supported version. SaaS instances were patched automatically on Oct 8-9.
Plex Media Server: CVE-2026-96652, -96654, -96655, -96656
Four flaws entered KEV together on Oct 20: two SSRFs, a URL injection and a file path control issue. Chained, they allow remote code execution on an internet-facing Plex server. Press reports say attackers use this to install crypto miners and proxy malware. The fix is in 1.43.3.10861, released on Aug 3. CVSS scores differ by source (4.3 to 6.9); the individual scores look low, but that does not reduce the danger of the chain.
Next.js: GHSA-673q-mjm6-r5xr (no CVE assigned)
If an App Router app uses Cache Components and has a use cache function that returns multiple typed arrays, an unauthenticated attacker can run code (CWE-502, CVSS 4.0: 9.5). Affected: 16.0.0 through 16.4.0. Fixed in 16.4.1. The advisory says there is no known workaround and recommends upgrading even if you have no similar function. No exploitation has been recorded.
| Flaw | Product | Issue | CVSS | Exploited? | Fix |
|---|---|---|---|---|---|
| CVE-2026-102764 | BeyondTrust Remote Support | Auth bypass, file upload | 9.3 (4.0) | yes (KEV, Oct 16) | BT26-05-RS |
| CVE-2026-96652/54/55/56 | Plex Media Server | SSRF, URL injection, file path | 4.3-6.9 | yes (KEV, Oct 20) | 1.43.3.10861 |
| GHSA-673q-mjm6-r5xr | Next.js | Remote code execution via typed arrays | 9.5 (4.0) | no record | 16.4.1 |
| CVE-2026-114509 | Laravel TokenGuard | Login as another user | 9.2 (4.0) | no record | 13.29.0 / 12.68.0 |
| CVE-2026-112398 | Pillow | Heap overflow in FPX decoder | 9.2 (4.0) | no record | 13.0.0 |
| CVE-2026-115889 | Wasmtime | Cranelift miscompilation, sandbox escape | 9.9 (3.1) | no record | 36.0.19 / 43.0.0 |
| GHSA-cg2g-xh64-v4q7 | DOMPurify | Template expression filter bypass | 9.2 (4.0) | no record | 3.4.17 |
“No record” means the sources show no exploitation; it does not prove there is none. The 4.0 and 3.1 in brackets mark the CVSS version. Scores from the two versions are not directly comparable.
BeyondTrust timeline
- Aug 29 · First confirmed exploitation · According to press reports
- Sep 27 · BeyondTrust alerted
- Oct 8-9 · Fix released · SaaS instances patched automatically
- Oct 15 · Public disclosure · Advisory BT26-05
- Oct 16 · Added to CISA KEV · Federal deadline Oct 19
Most dates rest on a single news report; only the KEV date and deadline were checked against CISA’s own catalog. The same report says attackers deleted logs, so the appliance’s own records are not enough evidence on their own. Check external firewall and SIEM logs.
What happened to the flaws from earlier posts?
| Flaw | First covered in | Status this week |
|---|---|---|
| Windows Shell, CVE-2026-96951 | Weekly Security Bulletin #1 | Fixed in the October update. The third exploited Shell flaw this year. The same update closed more than 1,400 flaws, 55 of them wormable (DHCP Server, Remote Desktop Gateway, NPS) |
| Citrix NetScaler, CVE-2026-88771/88772/88779 | Monthly Cyber Threat Report #1 | CISA updated its alert on Oct 9: CVE-2026-107406 was added and the link between 88779 and 88771 was clarified. Checking for signs of compromise before patching is advised |
| PAN-OS, CVE-2026-0322 | Monthly Cyber Threat Report #1 | Entered KEV on Oct 14. For the older CVE-2026-0257 in the same product, Unit 42 reported use by ransomware groups (Qilin, Inc) between Oct 19 and 23 |
| AhsayCBS and Cisco Secure Email Gateway | Monthly Cyber Threat Report #1 | All three entered KEV on Oct 14 with a deadline of Oct 17 |
| PHP2Shell, CVE-2026-109618/109619 | PHP2Shell post (Oct 22) | According to Recorded Future about 79% of PHP services that show a version run unsupported branches. Fixes: 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
The week in numbers
| Records | |
|---|---|
| Critical | 6 |
| Important | 298 |
| Moderate | 747 |
| Low | 174 |
| Added | |
|---|---|
| Oct 14 | 4 |
| Oct 15 | 1 |
| Oct 16 | 2 |
| Oct 20 | 6 |
| Oct 23 | 2 |
| Added | |
|---|---|
| Apr | 31 |
| May | 21 |
| Jun | 23 |
| Jul | 26 |
| Aug | 31 |
| Sep | 43 |
| Oct* | 26 |
Which products are the new KEV entries?
- Media and file servers > Plex Media Server | 4
- Backup and management > AhsayCBS | 2
- Backup and management > SiteGuard Server | 1
- Network and remote access > BeyondTrust Remote Support | 1
- Network and remote access > PAN-OS | 1
- Network and remote access > Fortinet (multiple products) | 1
- Network and remote access > Arista VeloCloud Orchestrator | 1
- Email and collaboration > Cisco Secure Email Gateway | 1
- Email and collaboration > Atlassian (multiple products) | 1
- Email and collaboration > Collabora Online | 1
- Enterprise software > Siemens Software Center | 1
What kind of weakness do the 15 new KEV entries represent?
- New KEV entries > Command and code injection | 4
- New KEV entries > File and directory access | 4
- New KEV entries > Authentication | 2
- New KEV entries > SSRF | 2
- New KEV entries > SQL injection | 1
- New KEV entries > URL and input validation | 1
- New KEV entries > Search path control | 1
- Command and code injection > AhsayCBS, SiteGuard, Collabora, PAN-OS | 4
- File and directory access > Fortinet, Cisco, Atlassian, Plex | 4
Most common weakness types (CWE) in Red Hat records
- CWE-825, expired pointer · 105
- CWE-125, out-of-bounds read · 95
- CWE-770, allocation without limits · 68
- CWE-476, null pointer · 58
- CWE-787, out-of-bounds write · 56
- CWE-772, resource not released · 49
- CWE-416, use-after-free · 45
| Records | |
|---|---|
| curl | 23 |
| hugo | 9 |
| tomcat10 | 8 |
| nodejs24 | 8 |
| grafana13 | 6 |
| maven3 | 6 |
Critical records of the week
- CVE-2026-114612 (litellm): reuse of the salt key across domains allows privilege escalation to proxy admin. CVSS 8.8, rated critical by Red Hat.
- CVE-2026-97631 (edk2): pre-boot remote code execution in the EDK II PXE driver, CVSS 8.8.
- CVE-2026-110858 (GitPython): command injection through the
Remote.pull()refspec; 3.1.30 up to 3.2.0 is affected, CVSS 8.1. - CVE-2026-71195 (manila): a public share can write access rules and export metadata of other projects, CVSS 8.8.
- CVE-2026-91403 and CVE-2026-114406 (OpenJDK, ca-certificates): trust in eMudhra intermediate certificates is withdrawn. It is a trust decision; CVSS 6.8.
Browsers, developer tools and server software
- Chromium: memory corruption in Skia (CVE-2026-113341) and use-after-free in Prerender (CVE-2026-110922), both 9.6; use-after-free in ReadingMode (CVE-2026-113274), 8.8. Update the browser and restart it.
- Storybook (CVE-2026-114125 and -114126): code execution through weak message-origin limits and an exposed WebSocket token, 8.8. Do not expose the dev server to the network.
- jupyter-server (CVE-2026-114135): code execution through a missing authorization check, 8.8. happy-dom (CVE-2026-115895): code execution via an ES module import alias, 8.8. Dulwich (CVE-2026-114094): drive letters in repository paths, 8.8.
- MySQL (CVE-2026-101781): server takeover through Group Replication GCS, 8.8. FreeRDP (CVE-2026-114045): heap overflow in server rdpsnd, 8.8. Streams for Apache Kafka Console (CVE-2026-105312): tenant-controlled container image, 9.9.
GitHub Advisory Database: other critical advisories
- @sentry/nextjs (CVE-2026-114139): middleware bypass when the tunnel route is used.
- labstack/echo/v4 (no CVE): rejected WebSocket upgrades can bypass route-level access controls.
- Pillow (CVE-2026-96639): multi-frame loaders can reuse stale native image storage.
- obsidian-tc (CVE-2026-77363 and -77366): no Origin or DNS-rebinding protection on the HTTP transport; tokens can reach any configured vault.
- Check each GitHub advisory page for the fixed version; the list page does not show it.
Full list of new KEV entries (Oct 14-23)
| Flaw | Product | Type | Added | Due |
|---|---|---|---|---|
| CVE-2026-114625 | Arista VeloCloud Orchestrator | SQL injection | Oct 23 | Oct 26 |
| CVE-2026-110447 | Collabora Online (CODE) | OS command injection | Oct 23 | Oct 26 |
| CVE-2026-106931 | SiteGuard Server | OS command injection | Oct 20 | Oct 23 |
| CVE-2026-96656 | Plex Media Server | File name/path control | Oct 20 | Oct 23 |
| CVE-2026-96655 | Plex Media Server | SSRF | Oct 20 | Nov 3 |
| CVE-2026-96654 | Plex Media Server | URL injection | Oct 20 | Oct 23 |
| CVE-2026-96652 | Plex Media Server | SSRF | Oct 20 | Nov 3 |
| CVE-2026-110936 | Siemens Software Center | Search path control | Oct 20 | Nov 3 |
| CVE-2026-102764 | BeyondTrust Remote Support | Authentication bypass | Oct 16 | Oct 19 |
| CVE-2025-61624 | Fortinet (multiple products) | Path traversal | Oct 16 | Oct 19 |
| CVE-2026-21589 | Atlassian (multiple products) | File/directory access | Oct 15 | Oct 18 |
| CVE-2026-105134 | AhsayCBS | Command injection | Oct 14 | Oct 17 |
| CVE-2026-105133 | AhsayCBS | Authentication | Oct 14 | Oct 17 |
| CVE-2026-76519 | Cisco Secure Email Gateway | Relative path traversal | Oct 14 | Oct 17 |
| CVE-2026-0322 | PAN-OS | Code injection | Oct 14 | Oct 17 |
From third-party trackers: WordPress plugins and enterprise software
- Among OpenCVE records updated on Oct 24, Tribulant Newsletters (CVE-2026-94075, 9.8) and Postiz (CVE-2026-115931, 9.9) stand out.
- According to a CVE summary site, Oracle E-Business Suite Workflow (CVE-2026-101809) and JD Edwards Orchestrator (CVE-2026-91299) score 10.0, and there are 9.9 records for Splunk Enterprise and SOAR. Verify against vendor advisories, since this is a third-party summary.
- When a new WordPress plugin flaw appears, the safest move is to deactivate the plugin until you can update it.
What to do this week
Order of priority
- Check BeyondTrust · If you run self-hosted Remote Support, apply BT26-05-RS. If it was internet-facing before Oct 9, treat the appliance as compromised, rotate stored credentials and check external logs.
- Update Plex · Version 1.43.3.10861 or later. Take internet-facing Plex servers offline unless needed.
- Check your Next.js version · If you run 16.0.0-16.4.0, move to 16.4.1, even if you do not use use cache.
- Scan dependencies · Laravel 13.29.0 / 12.68.0, Pillow 13.0.0, Wasmtime 36.0.19 / 43.0.0, DOMPurify 3.4.17.
- Do not forget PHP · 8.2.35, 8.3.36, 8.4.27 or 8.5.12; details are in the PHP2Shell post.
- Restart your browser · Check for the latest version in Chrome and other Chromium browsers.
- Revisit older KEV products · If you use PAN-OS, Citrix, Ahsay, Cisco, Fortinet or Atlassian, verify the relevant patches.
How we read the sources this week
- + CISA KEV: proof of exploitation and deadlines
- + Red Hat: severity, CWE and package data in one API
- + GitHub Advisory: affected and fixed versions per package
- + Vendor advisories: patch name and affected range
- - Red Hat covers only records relevant to its own products, not every CVE in the world
- - CVSS scores vary by source and version (the Plex case)
- - Exploitation dates often rest on one news source
- - Third-party trackers do not replace vendor advisories
- What does it mean to be in KEV? · CISA has confirmed the flaw is used in real attacks. Federal agencies usually get between three days and two weeks to patch.
- Is a flaw without a CVE number real? · Yes. Some advisories, like the Next.js one, are first published with only a GHSA number; a CVE can be assigned later.
- The Plex scores are low. Is it still urgent? · Yes. Flaws that look minor on their own can chain into code execution, and the KEV entry shows exploitation is real.
- Do the large Red Hat numbers concern me? · Only if you use those packages. The package and CWE spread hints at which components get patched most.
- When is the next bulletin? · Every week. The status of this issue’s flaws will appear in the next one.
- 🛡️ · Series · The same shape every week: urgent items, numbers, what to do.
- 🔎 · Sources · Red Hat, CVE.org, OpenCVE, GitHub Advisory, CISA KEV.
- 🌍 · Two languages · Turkish and English side by side.
- 🔁 · Follow-up · The status of earlier flaws is updated in each issue.
Method and limits
- Period: Oct 14 to Oct 23, 2026 (records published on Oct 24 are not counted). The first hours of Oct 14 were partly counted in the previous issue; this issue takes the full day.
- Red Hat counts come from the Red Hat Security Data API
after=2026-10-14query, using each record’spublic_date. The Oct 18 spike comes from a bulk publication and can overstate the weekly load. - KEV counts come from CISA’s catalog version 2026.10.23, using
dateAdded. - Package counts use the first package listed per record; the treemap and sankey groupings are specific to this post.
- Fixed versions come from GitHub advisories and vendor statements. Some Plex and BeyondTrust details rest on press reports.
- This post is not a security audit and does not replace verifying your own environment.