Plex2Shell Exploited: Plex Media Server Chain Hits KEV

Attackers are exploiting Plex2Shell, a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656), to run code on internet-facing servers older than build 1.43.3.10861. Exploitation started on October 17, one day after the public proof of concept. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20. Plex says any exposed server below 1.43.3.10861 may already be compromised: update it first, then check it for miners and proxy software.

What happened with Plex2Shell

Researcher Zach Main reported the issues to Plex on July 27, 2026. Plex acknowledged them on August 4 and paid a bounty. CVE IDs were assigned on September 23, with CISA acting as the CVE numbering authority and publishing coordination advisory VA-26-266-01. Plex posted a security notice on September 1 telling every server owner to update to 1.43.3 or newer, but it did not list the CVEs until October 20.

Main published the full write-up and proof-of-concept code on October 16. According to The Hacker News, a researcher running an older Plex build as a honeypot recorded the published exploit being used against it the next day. On October 20 Plex updated its forum notice: the flaws "are being actively and widely exploited," and compromised servers are running cryptocurrency miners and proxy software that routes other people's traffic through the victim's connection.

CISA's KEV entries carry a due date of October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for CVE-2026-96652 and CVE-2026-96655. CVE-2026-96656 is also flagged for forensic triage under BOD 26-04, so federal agencies have to look for compromise, not just patch.

Who is affected

Every Plex Media Server build before 1.43.3.10861 is affected, on every platform: Windows, macOS, Linux, Docker, NAS packages and NVIDIA Shield. The CVE records list 1.43.3.10861 as the first unaffected build.

Check the full build number, not just "1.43.3". Plex's general release thread announced 1.43.3.10828, while the CVE records, CISA's advisory and Plex's own October 20 post all name 1.43.3.10861 as the fixed build. The Hacker News reports that 1.43.3.10861 shipped on August 3. Plex's public notice is dated September 1. Either way, a server that has been on auto-update since September should be fine; a NAS package that lags the vendor app store may not be.

Servers that are reachable from the internet are the ones at risk. That includes servers with port 32400 forwarded on the router and servers exposed through Plex's Remote Access feature. Plex runs on home labs, but it also turns up on office NAS boxes, staff-owned machines on corporate VPNs and cloud VMs, which is where this becomes an IT problem.

Technical analysis

None of the four bugs looks critical on its own. The CVE records score them between 4.3 and 7.2 on CVSS 3.1 and between 5.3 and 8.6 on CVSS 4.0. Main scores the chain at 9.8, because together they give an unauthenticated attacker code execution. We explain why that gap matters for triage in why vulnerability chaining beats CVSS scores in triage.

At a high level, according to the CVE records and Main's write-up:

CVE-2026-96652 (SSRF, CWE-918): the /player/timeline companion endpoint checks only that a token header is present, not that it is valid. That lets an outsider make the server send requests to itself on the loopback address.
CVE-2026-96654 (CWE-84): the agent plugin API trusts loopback requests and does not neutralize values passed to searchOne. That lets the attacker call other plugin functions, which leaks the server owner's admin token.
CVE-2026-96655 (SSRF): with the owner token, the transcoder fetches media from any host the attacker chooses.
CVE-2026-96656 (CWE-73): a transcoder preference lets an admin write files into the Codecs directory. Plex loads every .so in that directory at transcoder startup without signature checks, so the planted file runs as the Plex service account.

Plex's October 20 table labels CVE-2026-96654 and CVE-2026-96655 a little differently from the CVE records (it calls CVE-2026-96655 the owner token disclosure). The chain and the fix are the same whichever labels you use. A fifth flaw from the same report, CVE-2026-96651, is not in KEV.

Persistence is the important detail. The planted library sits in the Codecs folder and runs again on every transcode, so killing the miner process does not clean the server.

Indicators of compromise

Plex and The Hacker News report these indicators:

Child processes of Plex Media Server named myawesomeproxy, mylovelyminer or x12345. VirusTotal classifies myawesomeproxy as a Linux backdoor and reverse proxy. mylovelyminer is an XMRig miner.
Unfamiliar .so or .dll files in the Plex Codecs folder.
Transcoder options in Preferences.xml that nobody set.
Outbound connections to proxystream.st (including ota.proxystream[.]st), or sustained high CPU use while nothing is playing.
Payload downloads from 217.60.194[.]116. Scanning and exploitation came from 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222.

The Hacker News notes that Bitsight linked another subdomain, global.relay.proxystream[.]st, to the AISURU DDoS and proxyware botnet in August. A hijacked Plex box is a rented exit node for someone else's traffic. Our explainer what is proxyware and why attackers install it covers what that means for an organization whose IP addresses end up in other people's abuse logs.

What to do now

Update. In Plex Web, open Settings, then General, and confirm the version is 1.43.3.10861 or newer. On NAS devices, install the package manually from the Plex downloads page if the vendor app store has not caught up. For Docker, pull the current image as described in Plex's pms-docker repository.
Check for compromise. Updating removes the bugs but not a planted library. Work through the indicators above. Our step-by-step guide on how to check a Plex server for compromise covers each one.
If anything turns up, rebuild. Plex recommends a clean installation without reusing the old data directory. At minimum, empty the Codecs folder and review Preferences.xml. Then sign out of all devices from the Plex account settings and change the Plex password.
Scope the blast radius. Treat anything the Plex service account could reach as exposed: mounted shares, credentials stored on the same host or VM, and other services on that network segment. Our guide on why to rebuild before you rotate credentials explains the order of operations.
Close the exposure. If nobody needs to stream from outside, turn off Remote Access in Plex settings and remove any port 32400 forward on the router.

For corporate networks, search for Plex on the asset inventory and on perimeter scans. Any instance on a company IP address is now a KEV item with an October 23 deadline for two of its CVEs.

What to watch next

Watch for Plex to confirm whether the September 1 notice covered these exact fixes, and for any indicators beyond the first honeypot report. The proxystream infrastructure overlaps with an existing proxyware botnet, so expect the same operators to keep scanning for unpatched builds. Expect more scanners to fingerprint port 32400 now that the chain is in KEV.