Plex Media Server Owners Urged to Update Immediately After In-the

Owners of Plex Media Server instances that remain on outdated software face an urgent need to apply the latest updates after a security researcher documented active exploitation of a vulnerability chain that allows unauthenticated remote code execution. The issue centers on four related flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, and collectively referred to as Plex2Shell, which affect versions of the media server software prior to the patched release 1.43.3.10861, according to a post on and the website zmain.info . Plex issued notices and direct emails to affected users around September 1, 2026, recommending upgrades for installations running 1.43.2 or earlier, yet large numbers of internet-exposed servers continue to run vulnerable builds, as confirmed by scanning data from organizations tracking exposed services.

The chain begins with an unauthenticated server-side request forgery condition that can be triggered through the player timeline endpoint when an attacker supplies any token value. Subsequent stages enable a pivot to internal agent functions on the loopback interface, theft of the server owner’s administrative token through crafted network callbacks, and manipulation of transcoder preferences to write attacker-controlled files into the Codecs directory. Once present, these files are loaded and executed when the transcoder initializes, granting code execution under the privileges of the Plex process. Public proof-of-concept code demonstrating the full chain appeared on October 16, 2026. Within roughly a day, a researcher operating an internet-facing honeypot running an older Plex version observed the published exploit being used against it on October 17.

The observed attack delivered an XMRig-based cryptocurrency miner along with a proxy application known as myawesomeproxy. The proxy component is designed to route external traffic through the compromised residential or network connection. Indicators associated with the activity include child processes spawned by the Plex Media Server binary, processes named myawesomeproxy, mylovelyminer, or x12345, and command-line arguments containing references to rig identifiers, donate levels, or the domain proxystream.st. Additional artifacts may include unexpected shared object or dynamic-link library files placed inside the Plex Codecs directory, which can persist and re-execute during subsequent transcoding operations. The researcher noted that the honeypot compromise required outbound connectivity from the target, consistent with the exploit’s need to stage payloads and callbacks.

Scanning platforms continue to index substantial numbers of exposed Plex servers still running versions susceptible to the chain. Earlier assessments in September had identified more than 36,000 internet-facing instances that had not applied the recommended updates. While the documented exploitation has so far been limited to a single controlled honeypot rather than a confirmed large-scale campaign against production systems, the public availability of working exploit code and the rapid weaponization observed raise the likelihood of broader opportunistic attacks against remaining unpatched servers, particularly those running on Linux or inside Docker containers and directly reachable from the internet.

Plex server owners are advised to upgrade Plex Media Server to version 1.43.3.10861 or newer without delay. After updating, operators of internet-exposed systems should review process trees for unexpected children of the main Plex binary, inspect the Codecs directory for unfamiliar binary files, and examine network logs for connections matching the known indicators. Remote Access features should be disabled if external connectivity is not required, and standard network segmentation practices should be applied to limit exposure of port 32400. Systems that may already have been compromised warrant a full review of user accounts, scheduled tasks, and outbound traffic patterns, with reinstallation from a clean base considered the most reliable recovery path in confirmed cases.