Plex2Shell: Exposed Plex Media Servers Hijacked for Crypto Mining and Proxies

Attackers are breaking into internet-facing Plex Media Server installations that have not been updated, using a chain of four vulnerabilities nicknamed Plex2Shell. Plex says compromised servers have been found running cryptocurrency miners and proxy software. CISA added all four flaws to its Known Exploited Vulnerabilities catalogue on 20 October.

The fix is Plex Media Server build 1.43.3.10861 or later.

The four flaws

• CVE-2026-96652: a server-side request forgery flaw in the /player/timeline endpoint.
• CVE-2026-96654: URL values are not neutralised, which lets an attacker call other plugins' functions with parameters of their choosing.
• CVE-2026-96655: a second request forgery flaw, through the path parameter of the universal transcode endpoint.
• CVE-2026-96656: an administrator setting for the H.264 transcoder is passed on unchecked, which can be used to write files that the server then loads.

On their own, the individual flaws are rated medium to high. Zach Main, the researcher who found and reported them, says they can be chained so that an attacker with no account obtains the owner's admin token and ends up running code as the Plex process. He rates the full chain 9.8 on CVSS 3.1.

Timeline

According to the researcher's disclosure, the flaws were reported to Plex on 27 July and acknowledged on 4 August. Plex says a public proof of concept appeared on 16 October, and its 19 October update confirmed active and widespread exploitation, mainly against servers that are reachable from the internet and have not been updated.

Plex's earlier advisory referred to version 1.43.2 and earlier, but its later update uses the build number as the cut-off, and the researcher lists some early 1.43.3 builds as vulnerable. The safe reading is that anything older than 1.43.3.10861 needs updating. The current version is shown in Plex Web under Settings, then General.

Signs a server has been compromised

Plex lists these indicators for servers that ran an older build while reachable from the internet:

• unrecognised processes, such as names like myawesomeproxy, mylovelyminer or x12345;
• unfamiliar .so or .dll files in the Codecs folder;
• outbound connections to proxystream.st;
• high CPU use while the server is idle.

What to do

1. Update to build 1.43.3.10861 or later.
2. Turn off Remote Access if it is not needed, and do not forward port 32400 directly to the server.
3. If compromise is found, or cannot be ruled out, Plex advises rebuilding from a clean installation, deleting the contents of the Codecs folder, checking Preferences.xml for unknown transcoder options, signing out all devices and changing the account password.
4. Treat anything the Plex service account could reach as exposed, including network shares and other devices on the same network.

Plex servers often run on home NAS boxes and small office machines that sit next to other devices and are rarely watched closely, which is what makes them attractive for mining and proxy networks.