Critical vulnerabilities in widely used platforms demand immediate attention, with some already under active exploitation. Among these, the Plex Media Server stands out as a high-priority concern due to confirmed unauthenticated remote code execution attacks targeting older, internet-exposed versions. Ton explores the importance of updating to version 1.43.3.10861 or later and emphasizes steps like investigating potential compromises and rebuilding systems to eliminate backdoors. This guide highlights the urgency of addressing such flaws to protect your infrastructure from escalating threats.
Dive into actionable strategies to secure your systems against these risks. You’ll gain insight into prioritizing patches for actively exploited vulnerabilities, such as those in Plex and Arista VeloCloud Orchestrator, while also preparing for potential threats from critical flaws in PHP and GitLab. Additionally, discover how to strengthen your defenses by updating essential components like Node.js, Pillow and Ubuntu packages. By following these steps, you can bolster your security posture and mitigate exposure to emerging attack vectors.
Plex Media Server: Actively Exploited Vulnerabilities
TL;DR Key Takeaways :
- Critical vulnerabilities have been identified in widely used platforms like Plex Media Server, Arista VeloCloud Orchestrator and Nextcloud Collabora CODE Server, with some already under active exploitation.
- Plex Media Server is a key target for attackers, with unauthenticated remote code execution vulnerabilities; immediate updates and system checks are recommended.
- Severe flaws in PHP and GitLab, though not yet actively exploited, pose significant risks and require urgent patching to prevent potential attacks.
- Updates for Node.js, Pillow and Ubuntu address critical security issues, including heap-overflow vulnerabilities and protocol weaknesses, necessitating prompt action.
- Prioritize patching based on exposure and exploitation likelihood, focusing first on actively exploited vulnerabilities, followed by critical flaws in other platforms.
The Plex Media Server has become a prominent target for attackers, with the Cybersecurity and Infrastructure Security Agency (CISA) confirming active exploitation. Older versions of the server, particularly those exposed to the internet, are vulnerable to unauthenticated remote code execution through a chained attack.
What You Should Do:
- Update to version 1.43.3.10861 or later immediately.
- If your server has been exposed to the internet, investigate for any signs of compromise.
- Consider rebuilding the system to ensure complete security and eliminate potential backdoors.
Arista VeloCloud Orchestrator On-Prem: SQL Injection Exploits
A critical SQL injection vulnerability (CVE-2026-114625) has been identified in Arista VeloCloud Orchestrator On-Prem, which is currently under active exploitation. Attackers can use this flaw by using a valid portal session and a low-privilege account to gain unauthorized access.
Mitigation Steps:
- Update to fixed versions: 5.2.3 build 18, 6.1.3 build 10, or 6.4.2 build 12.
- Restrict access to the web interface to minimize exposure.
- Monitor system logs and activity for unusual behavior that could indicate a compromise.
Here are more guides from our previous articles and guides related to Plex that you may find helpful.
- Perplexity Comet AI Browser : The Web Browser That Does It All
- Perplexity Comet AI Browser : Summarizes, Organizes and Works for You
- New Perplexity Spaces Feature Enhancing AI Research and Collaboration
- Combine NotebookLM & Perplexity for Faster Research, Better Reports & Slide Generation
- How Perplexity Lost the Al Race
- Best AI Models Compared: ChatGPT vs Gemini vs Claude
- Unlock Coding Superpowers with Perplexity’s AI Tools : Code Anything
- Perplexity Spaces vs Custom GPTs – Effortless Automation Systems Compared
- New Dell Optiplex 7090 Ultra PC hidden in monitor stand
- Apple Vision Pro 2 Leaks: Release Date, M5 Chip & New Design
Nextcloud Collabora CODE Server: OS Command Execution
The Nextcloud Collabora CODE Server is being actively targeted due to a vulnerability (CVE-2026-110447) that allows OS command execution under specific conditions. This flaw affects the richdocumentscode app, which is commonly used for collaborative document editing.
How to Secure Your System:
- Update to version 26.4.303 or later to address the vulnerability.
- If the app is not essential to your operations, consider removing it entirely to eliminate the risk.
PHP Remote Code Execution (RCE): Critical Flaws
Two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been discovered in PHP, affecting configurations such as Apache mod_php and PHP FPM. While no active exploitation has been reported, the severity of these flaws warrants immediate action.
Recommended Actions:
- Update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Review your PHP configurations to ensure they follow best security practices.
GitLab: CVSS 10 Vulnerability
GitLab has disclosed a critical vulnerability (CVE-2026-110264) with a maximum CVSS score of 10, indicating the highest level of severity. This flaw enables unauthenticated remote code execution and affects both the Community and Enterprise Editions of self-managed GitLab instances.
Steps to Protect Your Instance:
- Update to the latest supported versions, such as 18.11.13 or 19.5.1.
- Regularly monitor your GitLab instance for unusual activity or unauthorized access attempts.
Node.js: Addressing Brotli, DNS and TLS Issues
Recent updates to Node.js address vulnerabilities in Brotli compression, DNS handling, and TLS protocols. These flaws could expose applications to potential attacks if left unpatched.
What to Do:
- Update to versions 22.23.4, 24.22.1, or 26.12.1, depending on your deployment.
- Test your applications after updating to ensure compatibility and functionality.
Pillow: JPEG Heap-Overflow Vulnerability
A critical JPEG heap-overflow vulnerability has been identified in version 13.0.0 of the Pillow library. This flaw could allow attackers to execute arbitrary code if your applications process untrusted image files.
Mitigation Measures:
- Update to the latest version of Pillow immediately to address the vulnerability.
- Review your image processing workflows to minimize exposure to untrusted or malicious inputs.
Ubuntu: Security Fixes for Core Components
Ubuntu has released updates to address vulnerabilities in key components such as U-Boot, OpenVPN, and zlib. These updates are critical for maintaining the security and stability of systems that rely on these components.
Action Plan:
- Apply the updates based on your specific deployment and system requirements.
- Ensure all critical systems are running the latest patches to prevent potential exploitation.
How to Prioritize Patching
To effectively mitigate risks and secure your systems, follow this prioritization strategy:
- First, address actively exploited vulnerabilities in Plex Media Server, Arista VeloCloud Orchestrator, and Nextcloud Collabora CODE Server.
- Next, patch critical vulnerabilities in PHP and GitLab to prevent potential exploitation.
- Finally, update Node.js, Pillow, and Ubuntu packages to secure your environment against emerging threats.
By addressing these vulnerabilities promptly, you can significantly reduce the risk of compromise and ensure the continued security of your systems. Staying proactive in applying updates and monitoring for unusual activity is essential to maintaining a robust security posture.
Media Credit: Ton Does Linux and More!
Disclosure: Some of our articles include affiliate links. If you buy something through one of these links, Geeky Gadgets may earn an affiliate commission. Learn about our Disclosure Policy.
