Daily Brief
PHP emergency patches and Plex exploitation
PHP ships emergency patches for critical PHP2Shell flaws
PHP released emergency patches for two critical remote code execution flaws known as PHP2Shell. The bugs affect the PHP runtime itself, and reports say exploit attempts are already emerging, so unpatched web servers may be exposed even if the applications on top look current.
Prioritise patching PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on internet-facing servers this week, then check for signs of exploitation in web and process logs.
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
CISA warned that attackers are actively exploiting four Plex Media Server vulnerabilities in chained attacks dubbed Plex2Shell. The alert matters because it confirms real-world abuse of a widely used server product and raises the priority for exposed Plex instances.
Inventory all Plex Media Server deployments, patch to the fixed versions in the vendor guidance, and hunt for unauthorised changes, new accounts and unusual outbound connections.