Plex Media Server · Exploitation confirmed

CISA confirms active exploitation of Plex2Shell flaws in Plex Media Server

Oct 15, 2026 · 1 min read

Four Plex Media Server flaws, chained in attacks dubbed Plex2Shell, let an unauthenticated remote attacker run code with the server's privileges on internet-facing machines. CISA listed the flaws as actively exploited, and Plex reports widespread attacks with cryptocurrency miners and proxy software since a public proof of concept was released on October 16. Update to version 1.43.3.10861 or later; exposed, outdated servers should be treated as compromised.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 3 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Four Plex Media Server flaws, chained in attacks dubbed Plex2Shell, let attackers take over internet-facing servers without credentials. CISA listed the flaws as actively exploited and Plex reports widespread attacks. Compromised servers were used to mine cryptocurrency and route other people's traffic through the victim's connection.

Why it matters

Any internet-exposed Plex server older than 1.43.3.10861 may be compromised, with misuse of the company's processing, bandwidth and power. Files and credentials reachable by the server, such as shares mounted on the same machine, should be treated as exposed. The attacker needs no login or password.

What to do

Update every Plex server to 1.43.3.10861 or later immediately, including NAS and Docker installs. Check for unfamiliar processes, unknown files in the Codecs folder and connections to proxystream.st; exposed, outdated servers should be rebuilt from a clean install, with the Plex password changed. Turn off remote access if it is not needed.

For the technical team

CVE: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Affected: Plex Media Server · Plex Media Server before 1.43.3.10861. The Plex notice covers Plex Media Server v1.43.2 and earlier.
Exploitation: Active and widespread exploitation reported by Plex, with a public proof of concept released on October 16, per Plex. CISA listed the flaws as actively exploited, per BleepingComputer, which names the attacks Plex2Shell.
Fix: Plex Media Server 1.43.3.10861 or later (Plex also released Plex Desktop 1.115.0). Mitigation: turn off Remote Access under Settings and avoid forwarding port 32400 directly.
Vector: Chain of four Plex Media Server flaws: unauthenticated server-side request forgery in the player timeline endpoint (CVE-2026-96652), access to internal agent functions over the loopback interface (CVE-2026-96654), disclosure of the server owner's admin token (CVE-2026-96655) and arbitrary file write to the Codecs directory through transcoder preferences (CVE-2026-96656). Chained, they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process on internet-facing servers.
More details: Plex posted the original notice on September 1, 2026 and the CVE and exploitation details on October 19, 2026. Signs of compromise cited by Plex: Plex-started processes named myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in the Codecs folder, outbound connections to proxystream.st and sustained high CPU use with nothing playing. If compromised, Plex advises rebuilding the server from a clean installation rather than reusing the old data directory, deleting everything in the Codecs folder, checking transcoder options in Preferences.xml, signing out of all devices from the Plex account and changing the password. Treat mounted shares and credentials reachable by the service account as potentially exposed.