The living-room port was due today

Wednesday put four Plex names on the list. Two of them were due this morning.

CVE-2026-96654 and CVE-2026-96656, added 20 October, had a federal clock of 23 October. The other two Plex CVEs, SiteGuard Server Edition, and Siemens Software Center stay due 3 November. BOD 26-04 still wants the extra question on anything that was exposed: was it used before the patch landed.

A living-room Plex that was never on a civilian-agency network is not late for a directive it was never under. It is also not “fine because the due date was for someone else.” CISA added the rows because someone is using them. The two that were due today are the ones that needed the look first.

What “due today” will be asked to cover

It will be briefed as Plex was breached nationwide this morning. A due date is not a dump. It will be briefed as all four Plex rows equally. Two of them still have eleven days. SiteGuard is not a media server. Do not paste it onto a NAS.

If you run Plex on a reachable interface, the two Friday CVEs are the ones to be able to answer for. If you already pulled them, the remaining question is whether anyone used the old build. If you do not run Plex, this note is not your ticket.

Two due dates have passed. The library being up is not the answer.