NetScaler root takeover, Siemens app in ClickFix, Plex hijacks | Cyber Security News Oct 20

The NetScaler flaw that crashed appliances is a step in a root takeover whose implant tries to copy itself to the HA partner. ClickFix crews bring a signed Siemens program to run their malware, Plex servers are being hijacked a day after an exploit went public, and a fake WatchGuard download site collects VPN logins. Every version number and every fix in this episode was checked against the vendor's advisory, release notes or the CVE record before it aired. Today's question: Where does your team tell people to get the VPN client? Reply in the comments or at [email protected].

1. Update: NetScaler crash bug drives root takeover - CVE-2026-88771, CVE-2026-88779 - Do: Check both NetScaler HA nodes, rotate keys - https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779

2. ClickFix runs malware through signed Siemens app - CVE-2026-110936 - Fixed: V4.0.9.8 - Do: Alert on Siemens Software Center in AppData - https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/

3. Redis RESTORE flaw reported exploited - CVE-2026-25243 - Fixed: 8.6.5, 7.2.15 or 6.2.23 - Do: Block the RESTORE command in Redis ACLs - https://cyber.gc.ca/en/alerts-advisories/redis-security-advisory-av26-423

4. Plex2Shell exploited a day after the write-up - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 (+ 1 more) - Fixed: 1.43.3.10861 - Do: Update Plex Media Server - https://www.cve.org/CVERecord?id=CVE-2026-96652

5. Rank Math PRO downloads shipped a backdoor - CVE-2026-111862 - Fixed: 3.0.124 - Do: Restore affected Rank Math sites from backup - https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html

6. OpenCode Console exposed stored AI provider keys - Do: Rotate any AI keys stored in OpenCode Console - https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/

7. Update: GhostAction moves to phishing maintainers - Do: Turn off automatic tasks in VS Code - https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html

8. Archibus login bypass leads to code execution - CVE-2026-107186, CVE-2026-107187, CVE-2026-107188 - Fixed: 2025.02 - Do: Upgrade Eptura Archibus - https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed

9. Fake WatchGuard site steals VPN logins - Do: Give staff a bookmarked VPN client download link - https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing