Plex Media Server RCE chain 'Plex2Shell' exploited in the wild

Four Plex Media Server vulnerabilities chained together — dubbed Plex2Shell — are being exploited in the wild to drop cryptominers on self-hosted servers. The chain, scored 9.8 by the researcher who disclosed it, turns an unauthenticated request into code execution as the Plex service user. The flaws are fixed in Plex Media Server 1.43.3.10861; attacks began the day after proof-of-concept code went public.

The chain

Security researcher Zach Main reported the flaws to Plex on July 27, published technical details on October 16, and released PoC code three days later. Four CVEs link into a single path:

• CVE-2026-96652 — unauthenticated SSRF in /player/timeline.
• CVE-2026-96654 — URL injection in searchOne that invokes other plugins' functions; used to obtain the owner's admin token.
• CVE-2026-96655 — authenticated SSRF in the transcoder endpoint, reached with the stolen token.
• CVE-2026-96656 — arbitrary file write in transcoder settings that plants a shared object in the Codecs directory, which Plex then loads and executes.

The individual bugs rate medium-to-high; the full chain is what reaches critical. (One account also folds in a path-traversal, CVE-2026-96651, exposing the PlexOnlineToken; most writeups list the four above.)

Affected versions

Plex Media Server builds before 1.43.3.10861. The fixed build shipped in early August — months before the exploit went public — so this is an n-day problem: the patch has been available the whole time, and exposed servers simply were not updated.

Exploitation status

Confirmed. A honeypot run by BoredHackerBlog recorded the first attacks on October 17, initially against Plex honeypots, deploying the XMRig cryptominer and a proxy tool; Censys corroborated the activity. Bleeping Computer reports that CISA has warned of active exploitation and directed federal agencies to patch or mitigate by October 23.

Action checklist

1. Update Plex Media Server to 1.43.3.10861 or later now. The build has existed since August; there is no reason to still be behind it on an internet-reachable server.
2. Assume breach on exposed, unpatched servers. Public PoC plus confirmed exploitation since October 17 means an internet-facing instance may already be running attacker code.
3. Hunt for XMRig or other miner processes, unexpected outbound connections, and unfamiliar shared objects (.so) in the Plex Codecs directory — the chain's persistence foothold.
4. Take remote access off the internet. If you do not need Plex reachable externally, restrict it to the LAN or a VPN; disable remote access in server settings until patched and cleaned.
5. Rotate the Plex account token if the server was exposed; the chain's second stage steals it.

Context

Plex2Shell is a textbook patch-gap case: a fix available since August, public exploitation within 24 hours of the PoC. Self-hosted media servers sit in a blind spot — run by individuals and small teams, rarely on a patch schedule, and frequently exposed for remote access — which is exactly why miners and proxyware operators keep harvesting them. The LastPass breach began the same way, with an unpatched Plex server on an engineer's home machine. The lesson has not changed: if it is exposed, it is a production asset, patch it like one.