Weekly Threat Digest : 26th October to 1st November

Weekly Threat Digest

Weekly Threat Digest: 26 October to 1 November 2026 | Hive Pro Threat Advisory

Weekly Threat Digest/26 October to 01 November 2026

Weekly Threat Digest: Plex2Shell, Cisco ASA and FTD Zero-Day and Sirius Backdoor

HiveForce Labs reports three attacks, nine exploited vulnerabilities and one tracked adversary for 26 October to 1 November 2026, led by Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656), the Cisco Secure Firewall zero-day CVE-2026-76418 and the UpdraftCentral supply chain attack.

CVE-2026-109618CVE-2026-109619CVE-2026-111497CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656CVE-2026-105482CVE-2026-76418LazarusSirius BackdoorXMRigmyawesomeproxy

Published

November 2, 2026

Period

26 Oct - 1 Nov 2026

Attacks

Vulnerabilities

Adversaries

Total CVEs

543.8K

Published (week)

3,713

Exploited

Report type

Weekly digest

01 / Overview

Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, three major attacks were detected, nine vulnerabilities were actively exploited, and one threat actor group was closely monitored, signaling a concerning escalation in malicious activity worldwide.

Leading the week’s developments, Plex2Shell chains four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656) to give unauthenticated attackers full code execution. They reach internal functions, steal the owner’s administrator token, and drop a malicious library into the Codecs directory. Attackers are now mass-exploiting unpatched, internet-facing servers to deploy XMRig miners and myawesomeproxy proxyware, turning victims into paid relay nodes with a foothold in their networks. Meanwhile, Cisco disclosed CVE-2026-76418, a high-severity zero-day in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software. A single crafted request from an unauthenticated attacker can force the firewall to reload, knocking the device offline and cutting remote access for everyone behind it.

On the supply chain front, an attacker breached teamupdraft.com over the weekend of October 17-18, 2026, and took the vendor’s customer database, including UpdraftCentral Cloud connection keys. Within hours, they used those keys to push backdoor plugins to WordPress sites through the UpdraftCentral channel built into UpdraftPlus, a backup plugin with over four million active installations. Together, these incidents underscore a growing trend of hybrid cyber operations that combine technical exploitation with social engineering, reinforcing the need for timely patching, continuous monitoring, and layered security defenses.

02 / Insights

Insights

Attackers broke into teamupdraft.com and stole the UpdraftCentral keys, so one vendor breach reached WordPress sites that were never attacked directly.

Plex2Shell chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 into remote code execution, so update Plex Media Server now.

CVE-2026-105482 cuts a hostname short at a null byte, so an app can check one domain and look up a completely different one.

CVE-2026-76418 forces the firewall to reload, so remote staff, administrators, and partners can all be cut off at once.

Debian, Red Hat, OpenSUSE, and Ubuntu were all affected, so it doesn’t matter which Linux you run; you have updates waiting.

A fake FedEx tax invoice is delivering a new variant of the Sirius Backdoor, so think twice before opening any invoice you weren’t expecting.

Threat distribution

BackdoorCryptominerProxyware

Targeted countries

NorwayUnited StatesSlovakiaAlbaniaMonacoAndorraRomaniaAustraliaSwedenAustriaMaltaBelarusNetherlandsBelgiumPortugalBosnia and HerzegovinaSan MarinoBulgariaSouth KoreaCanadaUkraineCroatiaLuxembourgCzech RepublicMoldovaDenmarkMontenegroEstoniaNorth MacedoniaFinlandPolandFranceRepublic of IrelandGermanyRussiaGreeceSerbiaHoly SeeSloveniaHungarySpainIcelandSwitzerlandItalyUnited KingdomLiechtensteinLithuaniaLatviaArgentinaNew ZealandTurkmenistanArmeniaPhilippinesCubaSwazilandCuracaoMoroccoCyprusBruneiArubaRwandaDemocratic Republic of CongoCape VerdeAlgeriaTibetDjiboutiUruguayDominicaNauruDominican RepublicNorth KoreaEcuadorPanamaEgyptQatarEl SalvadorSaint LuciaEquatorial GuineaCanada QuebecAmerican SamoaChadEthiopiaTaiwanFaroe IslandsTongaFijiUnited Arab EmiratesAzerbaijanVietnamBahamas

Targeted industries

FinancialAirlineAutomotiveAviationBankingInsuranceLogisticsNGOsPharmaceuticalReligionTelecommunicationsUtilities

03 / Analysis

Attack Details

Sirius Backdoor

Type: Backdoor
Delivery method: Phishing
Overview: Sirius Backdoor is a Windows backdoor built with Microsoft Visual C++ that gives attackers remote control of an infected Windows machine. It keeps its settings either in the file’s resource section or in its own memory. Once running, it checks the victim’s computer to learn what it is and how well it is protected. It creates a lasting ID for the machine from the disk serial number and computer name. It also collects the CPU, GPU, RAM, screen size, and the user’s privilege level.
Affected platform: Windows
Impact: System Compromise

XMRig

Type: Cryptominer
Delivery method: Exploiting vulnerabilities
Targeted CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Overview: XMRig is an open-source cryptocurrency miner that is widely abused to hijack the processing power of compromised systems. In this campaign it is deployed on Plex Media Server hosts compromised through Plex2Shell, causing sustained degraded performance, high CPU use.
Affected product: Plex Media Server
Impact: Compute hijacking, higher power and hosting costs

myawesomeproxy

Type: Proxyware
Delivery method: Exploiting vulnerabilities
Targeted CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Overview: myawesomeproxy is proxyware that routes third-party traffic through the victim’s internet connection. When run, it displays a notice that running it means agreeing to external use of the device’s internet traffic. It communicates with victim IP proxystream infrastructure.
Affected product: Plex Media Server
Impact: Bandwidth hijacking, abused to relay traffic, harder attribution

The IOCs for the attacks executed are listed in the Indicators of Compromise section of this digest.

04 / Exploited

Vulnerability Details

CVE ID	Name	Affected product	Status	Actors / attacks	CWE	Associated TTPs
CVE-2026-109618	PHP2Shell (PHP Memory Corruption Vulnerability)	PHP Group PHP (5.4 through 8.5.11)	Celebrity: PHP2Shell	Lazarus	`CWE-1325` `CWE-416` `CWE-755` `CWE-824`	`T1190`, `T1059`
CVE-2026-109619	PHP2Shell (PHP Stale Internal Request-State Vulnerability)	PHP Group PHP (5.4 through 8.5.11)	Celebrity: PHP2Shell	Lazarus	`CWE-1325` `CWE-416` `CWE-755` `CWE-824`	`T1190`, `T1059`
CVE-2026-111497	Node2Shell / HTTP2Shell / Broccoli2Shell (Google Brotli Unchecked Return Value Vulnerability)	Node.js (22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1, and End-of-Life versions), Bun (before 1.4.4), Google Brotli (1.0.3 through 1.2.0), Python Brotli (before 1.2.1), brotlicffi (before 1.2.1.0), Microsoft .NET 8 (before 8.0.33), .NET 9 (before 9.0.22), .NET 10 (before 10.0.14), .NET 11 (before RC3)	Celebrity: Node2Shell / HTTP2Shell / Broccoli2Shell	–	`CWE-787` `CWE-252`	`T1190`, `T1059`, `T1499`
CVE-2026-96652	Plex2Shell (Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability)	Plex Media Server (Before 1.43.3.10861)	Celebrity: Plex2Shell	XMRig, myawesomeproxy	`CWE-918`	`T1190`
CVE-2026-96654	Plex2Shell (Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability)	Plex Media Server (Before 1.43.3.10861)	Celebrity: Plex2Shell	XMRig, myawesomeproxy	`CWE-84`	`T1190`
CVE-2026-96655	Plex2Shell (Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability)	Plex Media Server (Before 1.43.3.10861)	Celebrity: Plex2Shell	XMRig, myawesomeproxy	`CWE-918`	`T1190`, `T1550.001`, `T1105`
CVE-2026-96656	Plex2Shell (Plex Media Server External Control of File Name or Path Vulnerability)	Plex Media Server (Before 1.43.3.10861)	Celebrity: Plex2Shell	XMRig, myawesomeproxy	`CWE-73`	`T1190`, `T1129`, `T1574`
CVE-2026-105482	Node.js DNS Null Byte Truncation Vulnerability	Node.js 26.x (Before 26.12.1), Node.js 24.x (Before 24.22.1), Node.js 22.x (Before 22.23.4)	–	–	`CWE-284`	`T1190`, `T1071`
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability	Cisco Secure Firewall ASA Software (Before 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 / 9.24.10.1); Cisco Secure Firewall Threat Defense (FTD) Software (Before 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1)	–	–	`CWE-690`	`T1190`, `T1499`

Affected CPE

CVE ID	Affected CPE
CVE-2026-109618	`cpe:2.3:a:php:php::::::::`
CVE-2026-109619	`cpe:2.3:a:php:php::::::::`
CVE-2026-111497	`cpe:2.3:a:nodejs:node.js::::::::` `cpe:2.3:a:google:brotli::::::::` `cpe:2.3:a:microsoft:.net::::::::`
CVE-2026-96652	`cpe:2.3:a:plex:media_server::::::::`
CVE-2026-96654	`cpe:2.3:a:plex:media_server::::::::`
CVE-2026-96655	`cpe:2.3:a:plex:media_server::::::::`
CVE-2026-96656	`cpe:2.3:a:plex:media_server::::::::`
CVE-2026-105482	`cpe:2.3:a:nodejs:node.js::::::::`
CVE-2026-76418	`cpe:2.3:a:cisco:adaptive_security_appliance_software::::::::` `cpe:2.3:a:cisco:firepower_threat_defense::::::::`

Patch links

CVE-2026-109618www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109619www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-111497nodejs.org/en/blog/release/v22.23.4/
CVE-2026-111497nodejs.org/en/blog/release/v24.22.1/
CVE-2026-111497nodejs.org/en/blog/release/v26.12.1/
CVE-2026-111497bun.com/blog/bun-v1.4.4
CVE-2026-111497msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
CVE-2026-111497github.com/google/brotli/releases
CVE-2026-111497pypi.org/project/Brotli/1.2.1/
CVE-2026-111497pypi.org/project/brotlicffi/1.2.1.0/
CVE-2026-96652forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
CVE-2026-96652www.plex.tv/media-server-downloads/
CVE-2026-96654forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
CVE-2026-96654www.plex.tv/media-server-downloads/
CVE-2026-96655forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
CVE-2026-96655www.plex.tv/media-server-downloads/
CVE-2026-96656forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
CVE-2026-96656www.plex.tv/media-server-downloads/
CVE-2026-105482nodejs.org/en/blog/release/v22.23.4/
CVE-2026-105482nodejs.org/en/blog/release/v24.22.1/
CVE-2026-105482nodejs.org/en/blog/release/v26.12.1/
CVE-2026-76418sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

05 / Adversaries

Actor Details

Lazarus

Origin: North Korea
Motive: Information theft and espionage, Sabotage and destruction, Financial crime
Targeted industries: Government, financial, logistics, airports, manufacturing, and online transaction platforms
Targeted regions: USA, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU
Targeted CVEs: CVE-2026-109618, CVE-2026-109619
Affected product: PHP
TTPs: TA0001 Initial Access; TA0002 Execution; TA0003 Persistence; TA0007 Discovery; TA0006 Credential Access; TA0009 Collection; TA0005 Defense Evasion; TA0043 Reconnaissance; TA0042 Resource Development; TA0011 Command and Control; TA0008 Lateral Movement; TA0010 Exfiltration; TA0040 Impact; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1505 Server Software Component; T1505.003 Web Shell; T1098 Account Manipulation; T1098.004 SSH Authorized Keys; T1053 Scheduled Task/Job; T1053.003 Cron; T1033 System Owner/User Discovery; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1005 Data from Local System; T1211 Exploitation for Defense Evasion; T1595 Active Scanning; T1595.002 Vulnerability Scanning; T1590 Gather Victim Network Information; T1588 Obtain Capabilities; T1588.005 Exploits; T1608 Stage Capabilities; T1583 Acquire Infrastructure; T1583.004 Server; T1105 Ingress Tool Transfer; T1210 Exploitation of Remote Services; T1041 Exfiltration Over C2 Channel; T1496 Resource Hijacking; T1486 Data Encrypted for Impact

06 / Actions

Recommendations

01
Security Teams
Use this digest to prioritize the nine exploited vulnerabilities and block the indicators related to the threat actor Lazarus and the malware Sirius Backdoor, XMRig, and myawesomeproxy.
02
Uni5 Users
HivePro Uni5 customers can action this threat digest and get comprehensive insights into their threat exposure on the HivePro Uni5 dashboard by running a scan to discover the assets impacted by the nine exploited vulnerabilities, and by testing the efficacy of their security controls by simulating attacks related to the threat actor Lazarus and the malware Sirius Backdoor in Breach and Attack Simulation (BAS).

07 / Indicators

Indicators of Compromise (IoCs)

Attack	Type	Value
Sirius Backdoor	SHA256	`d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee`
Sirius Backdoor	MD5	`e8b080c276519547e95930ab15028adb`
XMRig	SHA256	`2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db`
myawesomeproxy	SHA256	`e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9`
myawesomeproxy	Domain	`proxystream[.]st`

08 / Mapping

Top MITRE ATT&CK TTPs

T1190

Exploit Public-Facing Application

T1059

Command and Scripting Interpreter

T1588

Obtain Capabilities

T1071

Application Layer Protocol

T1105

Ingress Tool Transfer

T1499

Endpoint Denial of Service

T1210

Exploitation of Remote Services

T1505.003

Web Shell

T1203

Exploitation for Client Execution

T1211

Exploitation for Defense Evasion

T1496

Resource Hijacking

T1212

Exploitation for Credential Access

T1550

Use Alternate Authentication Material

T1564

Hide Artifacts

T1036

Masquerading

T1098

Account Manipulation

T1505

Server Software Component

T1041

Exfiltration Over C2 Channel

T1005

Data from Local System

T1053

Scheduled Task/Job

09 / Reading

Threat Advisories

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro