{"metadata": {"vulnerability": "CVE-2026-96654", "count": 19, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-14T18:22:58.142Z", "date_only": false, "value": "2026-09-14T18:22:58.142955Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-09-14T18:22:58.142Z", "date_only": false, "value": "2026-09-14T18:22:58.142955Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T14:42:18.475Z", "date_only": false, "value": "2026-09-23T14:42:18.475Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:06:35.821Z", "date_only": false, "value": "2026-09-23T16:06:35.821Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T16:06:35.821Z", "date_only": false, "value": "2026-09-23T16:06:35.821Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96654", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T16:34:40.471Z", "date_only": false, "value": "2026-09-23T16:34:40.471558Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-23T16:34:40.471Z", "date_only": false, "value": "2026-09-23T16:34:40.471558Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-09-23T16:46:13.200Z", "date_only": false, "value": "2026-09-23T16:46:13.200Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96654", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-23T16:46:13.200Z", "date_only": false, "value": "2026-09-23T16:46:13.200Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96654", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.517Z", "date_only": false, "value": "2026-09-23T17:17:23.517", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3J7C-JR86-M5JQ", "record": "GHSA-3J7C-JR86-M5JQ", "field": "modified"}, {"timestamp": "2026-09-29T18:35:57.403Z", "date_only": false, "value": "2026-09-29T18:35:57.403", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96654", "record": "FKIE_CVE-2026-96654", "field": "lastModified"}, {"timestamp": "2026-10-18T23:02:48.864Z", "date_only": false, "value": "2026-10-18T23:02:48.864844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "312b45a4-3f00-4297-86dd-9a29037760a1", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-18T23:02:48.869Z", "date_only": false, "value": "2026-10-18T23:02:48.869546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "af972f61-9389-40e2-b3de-e78277ff7b5a", "content": "CVE-2026-96655 and CVE-2026-96654 affect Plex Media Server before 1.43.3.10861. The first is an authenticated server-side request forgery; the second lets an authenticated user invoke other plugins' functions. Fixed in version 1.43.3.10861.", "url": "https://bsky.app/profile/suriq.io/post/3my6pmq65ru2w"}, {"timestamp": "2026-10-19T13:25:26.325Z", "date_only": false, "value": "2026-10-19T13:25:26.325129Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "7da4246f-878c-4bf2-ba42-3d5c92c1053f", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.046Z", "date_only": false, "value": "2026-10-19T15:06:51.046600Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96654", "field": "creation_timestamp", "uuid": "9217f30b-8912-4ab4-931c-afa9f31101c4", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}]}