Arista EOS CVE-2026-7473: still unfixed, and no fix is coming
Arista's tunnel decapsulation flaw has been on CISA's KEV list since June, and Arista says no software fix is planned. Find the exposed switches and fence them with ACLs.
Known exploited vulnerabilities
Plex2Shell is being exploited: patch Plex, then assume compromise
A four-bug Plex Media Server chain is planting miners. The fix shipped in August; exposed servers older than 1.43.3.10861 should be treated as compromised.
