Four living-room bugs were due Friday

The catalogue grew by a media server. Friday is three days out.

CISA put six names in the Known Exploited Vulnerabilities catalog today. Four are Plex Media Server: two server-side request forgeries, one encoded-URI problem, one file-name control. Two of the four, CVE-2026-96654 and CVE-2026-96656, are due 23 October. The other two Plex rows, and Siemens Software Center, are due 3 November. EG Secure Solutions’ SiteGuard Server Edition is the sixth. The federal clock is BOD 26-04: patch what is exposed and check whether anyone used it before the patch.

A Plex box on a home network is not a civilian agency. It is also not “safe because it is a TV.” The due date is for systems the directive covers. Everyone else still has a port that CISA now says is being used.

What Friday will be asked to cover

It will be briefed as “Plex was breached.” A CVE on the list is evidence of exploitation somewhere, not a finding that your library left. It will be briefed as four equally urgent rows. Two of them are due in three days. Two are not. SiteGuard is a Japanese WAF product. Do not paste it onto a living-room NAS.

If you run Plex on a network that can be reached, treat the two Friday CVEs as a look, not only a pull. If you run SiteGuard or Siemens Software Center, those are separate rows. A patched box still needs the question the directive now asks: was it used first.

Four living-room bugs and a WAF and a software center. Keep the due dates on the right names.