Attackers are exploiting a four-flaw chain in unpatched Plex Media Server installations to run their own code, and Plex now says the attacks are active and widespread. The company updated its security notice on October 19 to warn that any server below build 1.43.3.10861 reachable from the internet should be considered at risk.
The chain, dubbed Plex2Shell, combines four vulnerabilities — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — that together let an unauthenticated remote attacker execute code with the privileges of the Plex Media Server process. SecurityWeek reported on October 19 that the chain was weaponized within hours of public disclosure, with attackers delivering cryptocurrency miners and proxy software.
According to Censys, the timeline runs from Plex’s initial security notice on September 1, to NVD publication on September 23, a public Plex2Shell write-up on October 16, and in-the-wild exploitation beginning October 17, per the plex2shell-check project.
How the chain works
Italy’s national cybersecurity agency ACN, which confirmed active exploitation in an October 20 advisory, describes the attack as beginning with unauthenticated server-side request forgery via the /player/timeline endpoint. The attacker then abuses the /system/agents/* searchOne endpoint over loopback to call internal agent functions and steal the admin token, and finally uses transcoder and codecs functionality to write and load a malicious shared library, achieving arbitrary code execution.
ACN assigns CVSS v3.1 scores of 4.3 to the two SSRF flaws (CVE-2026-96652 and CVE-2026-96655), 6.5 to CVE-2026-96654 (improper neutralization) and 7.2 to CVE-2026-96656 (external control of file name or path), rising to 9.8 when CVE-2026-96656 is chained with the others.
Who is affected
All Plex Media Server builds before 1.43.3.10861 across supported platforms — including Windows, macOS, Linux, NAS and Docker — are vulnerable, according to Censys, with servers exposing port 32400 directly to the internet at particular risk. Plex also urges Plex Desktop users to update to version 1.115.0. Betanews reported that builds 1.43.3.10861 and later are not affected.
Per Rescana, attackers are using the chain to deploy XMRig cryptocurrency miners and a stealthy Linux proxy backdoor called “myawesomeproxy”. Tenable flagged CVE-2026-96656 on October 21 as a high-severity vulnerability of interest, noting in-the-wild use to deploy a backdoor and crypto miner. A honeypot experiment summarized by Neoteo showed opportunistic scanning and successful infections against a simulated Plex server shortly after the Plex2Shell disclosure.
What to do
Upgrade to Plex Media Server build 1.43.3.10861 or later, which fixes all four flaws. The patched build was released on August 4, according to Censys; Windows and macOS users with automatic updates should verify their version, while Linux, NAS and Docker deployments must be updated manually.
Plex advises administrators who cannot rule out compromise to:
- Rebuild the server from a clean installation and delete everything in the Codecs folder
- Check for suspicious processes such as “myawesomeproxy”, “mylovelyminer” or “x12345”, and unfamiliar .so or .dll files in the Plex Codecs folder
- Review transcoder options in Preferences.xml
- Sign out of all devices and change the Plex account password
- Treat any resources accessible to the Plex service account — such as mounted shares and stored credentials — as potentially exposed
Plex also recommends disabling remote access if it is not needed and avoiding direct port forwarding of TCP 32400. Additional guidance from security coverage includes restricting Plex to local networks where feasible and using a reverse proxy rather than exposing the default port.
Victim counts and attribution remain unknown; neither Plex nor government advisories provide prevalence metrics, and no threat actor or group behind the miner and proxy campaigns has been publicly identified. Sources also differ on exactly which pre-1.43.3.10861 builds are vulnerable — CybersecurityNews notes the Plex2Shell repository identifies versions before 1.43.3.10828 as vulnerable — and Plex has not published a definitive build-level matrix.
One Response