Plex2shell Wz

jackalsyn.com • October 19, 2026

Share: View original

Hardened re-implementation of the Plex2Shell chain + an encrypted two-stage C2 beacon

plex2shell-wz is a weaponized, obfuscated re-implementation of the Plex2Shell (Found by ZM ) chain (CVE-2026-96652 / -96654 / -96655 / -96656), extended with an encrypted two-stage in-memory C2 beacon as a drop-in replacement for the plaintext reverse-shell listener. Each stage is written in Python (orchestration + C2 server) and C (dropped codec + in-memory beacon, libc-only house crypto). The weaponization exists to defeat the published detection ruleset that ships with the public PoC. Public view intentionally limits sensitive implementation details. If you have issues getting it to run (python importation), establish a venv inside of the respective directory (post wget & tar extract): python3 -m venv venv && \ venv/bin/pip install --upgrade pip && \ venv/bin/pip install urllib3 Follow up with either source venv/bin/activate or venv/bin/python3 to run the scripts. Finally, as of making this post, there are over 680k+ Plex servers exposed to the public internet. If you are a security researcher, please responsibly disclose any findings to Plex. Shodan: product:"Plex Media Server" -version:1.43.3.10861 -version:1.43.4 -version:1.43.5 FoFa: app="Plex Media Server" && country="US" && port="32400" Lab: dockerVulnPlex-plex2shell a dockerized vulnerable Plex server for testing the chain.

plex2shell-wz (beacon)/

Click directories to expand · click files to view content

How to Validate, Build & Run plex2shell-wz

Usually I password protect my releases, however this time it is a straight shot:

tar -xzf plex2shell-wz.tar.gz

hash(256) 53ac4e570f6d95181ca96c906fb46691f5eac0daf7eabe245804c59803b3be94

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Urgent Update Required for Vulnerable Plex Media Servers Amid Active Exploitation Plex Media Server users are urged to update their software immediately due to the active exploitation of a vulnerability chain known as Plex2Shell, which allows unauthenticated remote code execution. This chain involves four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, affecting versions prior to 1.43.3.10861. Despite Plex notifying users to upgrade by September 1, many servers remain vulnerable, with over 36,000 instances still exposed. A proof-of-concept was published on October 16, 2026, and attacks were observed on October 17, delivering cryptocurrency miners and proxy applications. The exploitation method includes server-side request forgery and arbitrary file writes, leading to remote code execution. Community reports of compromised servers have not been confirmed by Plex or CISA. Users are advised to check for unexpected processes and files in their installations. 2 sources 72

Extracted Entities

Attack Types (1)

CVEs (1)

Malware (1)

MITRE ATT&CK (2)

T1059 - Command and Scripting Interpreter T1071 - Application Layer Protocol

Platforms (2)

Plex Media Server Urllib3

SHA256 Hashes (1)

53ac4e570f6d95181ca96c906fb46691f5eac0daf7eabe245804c59803b3be94

Tools (6)

dockerVulnPlex FOFA Python Shodan tar wget

Vulnerabilities (1)