Tuesday’s brief: a backdoored Rank Math PRO update, hijacked Plex servers and a signed Siemens app used for malware

Good morning. A backdoored Rank Math PRO build went out through the vendor’s own update channel last week, and sites that activated it need a restore, not just an update. Plex servers that missed an August fix are being taken over, and a signed Siemens app is being used to slip ClickFix malware past defenses. Here is the order we would take them.

Lead Story

Rank Math PRO copies downloaded or updated on October 15 and 16 carried a self-restoring backdoor. Check your update time →

Also Worth Your Attention

Attackers are using the Plex2Shell chain on Plex Media Server older than 1.43.3.10861. Find your build number →

A genuine, signed Siemens Software Center is loading ClickFix malware on Windows PCs. Hunt by folder →

Also on the radar: ConnectWise disabled seven Cloud Backup and Cloud Management application identities on October 17 after attackers used them to request Microsoft Graph tokens from customer Microsoft 365 tenants. MSPs should review consent and service principal sign-ins in every tenant (ConnectWise advisory, Sophos X-Ops).

Source: Rank Math notice; Plex security notice; Siemens SSA-580366; ConnectWise Trust Center

Go Deeper

• Identity and access management: admin accounts, app consent and token reviews
• Cybersecurity tools for scanning sites and hunting on endpoints

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].