Cybersecurity news for Monday, November 9, 2026.
The stories were published on Monday, November 9, 2026. Added on Monday, November 9, 2026.
Attackers reportedly use Plex2Shell flaws against Plex media servers, SecurityWeek and Cyber Security News report
Reported by SecurityWeek and Cyber Security News, both published Monday, November 9, 2026.
What happened
SecurityWeek reports that attackers are using Plex2Shell to get into Plex Media Server software running on QNAP NAS devices. A NAS is a storage box that connects to a network. SecurityWeek says QNAP reports that some users were compromised, and that the article gives no count. Cyber Security News reports that attackers are breaking into unpatched Plex Media Server systems and installing a cryptocurrency miner and a proxy tool. It says it does not know how many servers were hit.
What the reports say about how it happened
Both outlets say Plex2Shell is a chain of four flaws in Plex Media Server. Cyber Security News says the exploit code went public on October 16, 2026, and that a researcher saw the first real attack on October 17. SecurityWeek says the flaws were patched this summer, and that QNAP NAS users should update Plex Media Server to version 1.43.3 or later. Cyber Security News says an update does not remove a payload that was installed earlier. Both outlets advise against forwarding port 32400 if remote access is not needed.
Researchers reportedly used a default password to unlock and start test cars, The Hacker News and Cyber Security News report
Reported by The Hacker News and Cyber Security News, both published Monday, November 9, 2026.
What happened
The Hacker News reports that the login systems for two car brands' mobile apps could be fully taken over. It says the researchers were able to unlock the doors of a test car and start its engine. Cyber Security News says this was controlled security research and that no criminal campaign has been reported. Both say the two automakers are not named.
What the reports say about how it happened
The Hacker News says the researchers got into an administrator console on those servers, and it was still set to its default password, admin and admin. Cyber Security News says a firewall for web applications stopped direct requests to those services, but specially encoded paths got around it. Both say the automakers fixed the problem about two hours after the report. Neither article gives advice for car owners.
Amplifon Americas reports a data breach affecting more than 1.3 million people, SecurityWeek reports
Reported by SecurityWeek, published Monday, November 9, 2026.
What happened
SecurityWeek describes Amplifon Americas as the arm in Minneapolis of Amplifon, an Italian hearing healthcare company. It reports that hackers got into its internal systems in January 2026. It says the company disclosed a breach affecting more than 1.3 million people in the US. SecurityWeek says the stolen data included names, driver's license numbers, dates of birth, medical information and health insurance information. It says Social Security numbers were also stolen for some people. SecurityWeek quotes the company: "We are not aware of any fraudulent use of personal information as a result of this incident."
What the article says about how it happened
SecurityWeek says the company contained the incident and began an investigation. It says reviewing the stolen data took the company eight months. It gives no advice for affected people, and we pass none on.
