Elsewhere, a separate section not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence Research or story?
CVE-2026-96656: Plex Media Server
file name or path control. server app. Rungs reached: 5 of 8. Part of Pulse, a separate section not about PHP.
Why Pulse tracks it: KEV catalog 2026.10.21: added in the two weeks from 8 to 22 October 2026
The evidence of exploitation, rung by rung
1. A public proof of concept: not reached
2. A nuclei template that exploits rather than only fingerprints: not checked
not checked: every source for this rung was blocked or has not been fetched yet
3. A merged Metasploit module: not reached
4. Exploitation attempts reported by a named party: not reached
5. A KEV listing (the date added): reached 2026-10-20
- Pulse's own check 2026-10-20KEV catalog 2026.10.23capture pulse:
raw/us/registry/cisa-kev/kev-json/20261024T055307Z/text.txt, 24 October 2026, 05:53 UTC, sha256c2c53427f552e3cforiginal
6. knownRansomwareCampaignUse: Known on KEV: not reached
7. A national CERT reporting compromises in its country: not reached
8. A named organisation saying it was compromised through that flaw: not checked
a victim's own statement is recorded by hand from a capture; none recorded
Measurements
- CVSS 3.1 7.2, scored by 9119a7d8-5eab-497f-8521-727c672e3725
- CVSS 4.0 8.6, scored by 9119a7d8-5eab-497f-8521-727c672e3725
- EPSS 0.00816, percentile 0.56677, 2026-10-23
The attention it gets
16 news items since 2026-09-24T06:09:45Z, counted over 2 of 137 feeds, in 1 languages and 1 countries; 0 front pages, 0 agency alerts, 0 pages advising taking systems offline.
Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count
Pulse vault 4klm5qlt, head c27972b6de6f, last pass 24 October 2026, 05:53 UTC.