Plex2Shell (CVE-2026-96656): Exposed Plex Media Servers Hijacked, Fixed in Build 1.43.3.10861

Attackers are breaking into internet-facing Plex Media Server installations that haven't been updated, using a chain of four vulnerabilities nicknamed Plex2Shell. In Plex's 19 October security update, the company says compromised servers have been used to run cryptocurrency miners and proxy software. CISA added all four flaws to its Known Exploited Vulnerabilities catalogue on 20 October.

Builds 1.43.3.10861 and later aren't affected, according to Plex.

The four flaws

• CVE-2026-96652: a server-side request forgery flaw in the /player/timeline endpoint.
• CVE-2026-96654: URL values aren't neutralised, which lets an attacker call other plugins' functions with parameters of their choosing.
• CVE-2026-96655: a second request forgery flaw, through the path parameter of the universal transcode endpoint.
• CVE-2026-96656: an administrator setting for the H.264 transcoder is passed on unchecked, which can be used to write files that the server then loads.

On their own, the flaws score medium to high in NVD's CVSS 4.0 ratings, with the transcoder flaw rated highest. In his write-up, Zach Main, the researcher who reported them, shows they can be chained so that an attacker with no account obtains the owner's admin token and ends up running code as the Plex process. He scores the full chain 9.8 on CVSS 3.1.

Timeline and affected builds

Main reported the flaws to Plex on 27 July, and Plex acknowledged them on 4 August, according to his disclosure timeline. In its 19 October update, Plex dates a public proof of concept to 16 October and calls the exploitation active and widespread.

Plex first posted an advisory on 1 September titled for version 1.43.2 and earlier. The October update draws the line at build 1.43.3.10861 instead, and the proof of concept published on GitHub lists builds up to 1.43.3.10828 as vulnerable.

Signs a server has been compromised

Servers that ran an older build while reachable from the internet should be checked for the indicators listed in Plex's update:

• unrecognised processes started by the server, such as myawesomeproxy, mylovelyminer or x12345;
• unfamiliar .so or .dll files in the Codecs folder;
• outbound connections to proxystream.st;
• sustained high CPU use while nothing is playing.

What to do

Plex recommends these steps in its 19 October update:

1. Update to build 1.43.3.10861 or later. Plex Web shows the current version under Settings, then General.
2. Turn off Remote Access if it isn't used, and avoid forwarding port 32400 directly.
3. If compromise is found, or can't be ruled out, rebuild from a clean installation rather than reusing the old Plex data directory. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options nobody set.
4. Sign out all devices from the Plex account settings and change the Plex password.
5. Treat anything the Plex service account could reach as potentially exposed, such as mounted shares and credentials stored on the same machine or virtual machine.