Researcher reports attacks on outdated Plex servers via Plex2Shell - Межа

A Plex server honeypot reportedly drew intruders who left behind unexpected software. A separate four-flaw chain makes outdated internet-facing installations especially worth checking.

An independent researcher reported that an internet-accessible Plex server had been compromised, with attackers deploying a cryptocurrency miner and a proxy. The Plex2Shell chain of four vulnerabilities allows unauthenticated attacks against vulnerable versions, so Plex Media Server owners should update immediately.

Photo: Server equipment, illustrative image. Source: Kevin Ache / Unsplash .

On October 18, the administrator of a honeypot server said that their Plex Media Server installation had been compromised in the early hours of October 17. According to the administrator, at least a cryptocurrency miner and a program that turned the server into a proxy had been uploaded. The researcher noted separately that, at the time of publication, they had seen no independent confirmation of the campaign.

The researcher shared the report in the Plex community on .

What’s known the attacks

The post’s author linked the incident to Plex2Shell, a chain of vulnerabilities in Plex Media Server. Researcher Zach Main published a technical description and proof-of-concept code on October 16. The public repository contains a tool for reproducing the chain, along with separate payload files for Linux and Windows.

In the same discussion, several users reported suspicious processes or attempts to exploit a similar chain. However, as of October 18, Plex and CISA had not published separate confirmation of widespread exploitation. Reports of an active campaign should therefore be treated as accounts based on several public reports, not as an officially established measure of the attack’s scale.

Plex2Shell combines four registered vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. According to CISA , individual flaws can allow an attacker to make the server send requests to arbitrary addresses, access internal plugin functions, and write files to arbitrary locations. Together, they can lead to remote code execution without logging into an account.

The author of Plex2Shell rated the full chain 10 out of 10 on CVSS 3.1. This rating applies specifically to the combined attack: CISA’s entries for the individual CVEs have different, lower scores. Plex Media Server versions earlier than 1.43.3.10861 are considered vulnerable.

Plex added the relevant fixes in version 1.43.3.10861, which it released to all users on August 4. In the release notes , the company mentioned protections for the CompanionProxy component and a restriction preventing remote changes to TranscoderH264Options settings. On September 1, Plex separately urged server owners and Plex Desktop users to upgrade to the latest versions.

What Plex owners should do

Photo: Checking the version and updates in Plex Media Server settings. Source: Plex .

First, install the latest available version of Plex Media Server. The minimum version that includes fixes for the four related CVEs is 1.43.3.10861. NAS users should check the version manually, as packages may take some time to appear in manufacturers’ app stores. For Docker, simply restarting an old container is not enough: you need to download the latest image and recreate the container using it.

If the server was accessible from the internet and running an older version, check it for unknown Plex child processes, unusual CPU usage, third-party downloads, and configuration changes. If there are signs of compromise, CISA recommends isolating the system from the network, preserving logs and other evidence, restoring it from a known-clean image, and replacing passwords, keys, and service secrets that may have been accessible on the host.

Plex adds social features and launches Discussions for conversations

cPanel vulnerability allowed attackers to bypass login and take over WHM panels

Apple Private Relay vulnerabilities could expose users’ real IP addresses