PUBLIC EXPLOIT CHAIN TARGETS UNPATCHED PLEX MEDIA SERVERS A researcher ...

X • October 19, 2026

A researcher published a full write-up and proof-of-concept on Oct 16, 2026 for "Plex2Shell", a chain of four Plex Media Server flaws that can end in remote code execution on servers older than 1.43.3.10861.

• Chain: CVE-2026-96652 (SSRF), CVE-2026-96654 (URL injection into plugin calls), CVE-2026-96655 (SSRF via transcode path) and CVE-2026-96656 (arbitrary file write that runs on load)

• CISA's advisory VA-26-266-01 (Sep 23) scores the individual CVEs 4.3 to 7.2; the researcher rates the combined chain as unauthenticated RCE

• Plex fixed the issues in 1.43.3.10861 and urged all server owners to update on Sep 1

• Community reports of compromised servers running miners and proxies have not been confirmed by Plex or CISA, and the CVEs are not in CISA KEV

Plex listens on port 32400 and is often exposed straight to the internet, and a working PoC is now public. Update to 1.43.3.10861 or later (NAS and Docker users must pull the new package or image manually), avoid direct internet exposure, and check older servers for unknown Plex child processes, new files in the Codecs folder and unexpected CPU load.

raw.githubusercontent.com/cisagov/CSAF/d…

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Plex2Shell Exploit Chain Actively Targeting Vulnerable Plex Servers A chain of vulnerabilities in Plex Media Server, termed Plex2Shell, is being by attackers to gain unauthorized access and deploy cryptocurrency miners and proxy software. The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, allow unauthenticated remote code execution on servers running versions prior to 1.43.3.10861. The first public proof-of-concept code was released on October 16, 2026, and exploitation was observed starting October 17, 2026, when a researcher operating a honeypot reported the deployment of a XMRig miner and a proxy tool called myawesomeproxy. Plex had previously issued a patch for these vulnerabilities on August 4, 2026, and advised users to update their installations. Despite this, many servers remain unpatched, with over 36,000 instances still exposed to the internet. The ongoing exploitation poses a significant risk to users who have not yet updated their systems. 27 sources 73

Extracted Entities

PUBLIC EXPLOIT CHAIN TARGETS UNPATCHED PLEX MEDIA SERVERS A researcher ...

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

Domains (1)

Platforms (2)

Tools (1)