Cybersecurity alerts issued for Plex vulnerability and ROMULUS malware platform

Cybersecurity researchers have identified new threats targeting media server users and general internet users through sophisticated delivery methods.

Plex users are advised to update to version 1.43.3 immediately to mitigate a vulnerability that allows for unauthenticated SSRF, security token theft, and payload execution. A researcher demonstrated that the exploit chain was developed using heavy assistance from artificial intelligence, which significantly accelerated the process of mapping vulnerabilities and verifying bugs.

Separately, researchers at Forescout Research - Vedere Labs disclosed the ROMULUS ClickFix platform. This service uses deceptive landing pages to trick users into running malicious commands, facilitating the distribution of malware such as Legion Loader. The platform operates via several identified IP addresses and has been linked to campaigns using malicious ChatGPT Custom GPTs to direct victims to fraudulent URLs.