Plex2Shell: Exploited RCE Chain in Plex Media Server

What to do

1. Check the full build number in Settings > General, or run curl -s http://127.0.0.1:32400/identity on the server.
2. Update to Plex Media Server 1.43.3.10861 or later; on Docker, pull plexinc/pms-docker and recreate the container.
3. Turn off Remote Access and remove any port 32400 forward if you do not need outside access.
4. Preserve the Plex logs, then check Preferences.xml, the Codecs folder and outbound traffic for the indicators below.
5. If anything turns up, rebuild from a clean install, sign out all devices, change the Plex password and rotate credentials for shares the server could reach.

How to check if you are affected or compromised

• Preferences.xml containing a TranscoderH264Options value with dump-yuv or stats= (an empty value is also worth a look).
• Plex logs showing /player/timeline/subscribe requests with a protocol URL, searchOne calls with /function/ in the identifier, or sslip.io / nip.io hostnames.
• Unfamiliar .so or .dll files in the Codecs folder, or processes such as xmrig or myawesomeproxy running as the plex user.
• Outbound connections to proxystream.st, downloads from 217.60.194.116, or high CPU while the server is idle.
• Run the researcher's read-only plex2shell-hunt.sh triage script on Linux and Docker hosts.

What happened#

On October 16, 2026, researcher Zach Main published Plex2Shell, a write-up and proof of concept that chains four Plex Media Server (PMS) bugs into code execution without any credentials. The next morning a honeypot run by BoredHackerBlog recorded the first exploitation in the wild. On October 19 Plex said in its security thread that the flaws are "actively and widely exploited." On October 20 CISA added all four CVEs to the KEV catalog.

The chain, as the researcher describes it:

• CVE-2026-96652: /player/timeline checks only that an X-Plex-Token header exists, not that it is valid. A crafted protocol parameter makes the server POST to any URL, including its own loopback interface (CVE record).
• CVE-2026-96654: loopback requests skip authentication on the internal /system/agents API, and searchOne does not neutralize URL values, so the attacker can call other plugins' functions.
• Owner token theft: PMS attaches the owner's admin token to outbound requests whose URL starts with http://127.0.0.1. Because that is a prefix match, a hostname like 127.0.0.1.<attacker>.sslip.io receives the token.
• CVE-2026-96656: with that token, the attacker sets the TranscoderH264Options preference, which PMS appends verbatim to x264's options, and triggers a transcode that writes a shared object into the Codecs folder. PMS loads every .so there at startup without signature checks (CVE record), so the code runs as the plex user.

The fourth CVE, CVE-2026-96655, is an authenticated SSRF in /video/:/transcode/universal. CISA, acting as CNA, scores the bugs individually from 4.3 to 7.2 on CVSS 3.1 (8.6 on CVSS 4.0 for the file write). The researcher scores the full chain at 9.8.

Who is affected#

Every PMS build older than 1.43.3.10861, on Windows, macOS, Linux, NAS packages and Docker. The Hacker News reports that the fix shipped on August 3. One trap: Plex's September 1 notice told users to move to "1.43.3," but the 1.43.3.10828 build released July 14 predates the fix. Check the full build number, not the first three digits. Plex now says any server older than 10861 that is reachable from the internet should be presumed possibly compromised.

Plenty of servers update slowly. In September, Shadowserver counted more than 36,000 internet-exposed PMS instances still unpatched against Plex's earlier advisory (BleepingComputer).

Do you really need to act?#

Yes, today, if the server is reachable from the internet. The chain needs no account, a working exploit is public, and CISA set an October 23 deadline for two of the four CVEs. What attackers install so far is a money-maker, not ransomware. BoredHackerBlog captured an XMRig miner and a tool called myawesomeproxy, fetched from 217.60.194.116. The proxy's startup banner says it may make "external use of your internet traffic." The Hacker News reports the miner talks to ota.proxystream[.]st, and that Bitsight tied another proxystream subdomain to the AISURU DDoS and proxyware botnet. A home Plex box on a residential IP is exactly what proxyware operators want. Code running as plex can also read your media libraries and any shares the server mounts, which is why Plex says to treat those credentials as exposed.

LAN-only servers are much less exposed, but the chain works from any device that can reach port 32400, so update them anyway. If your server auto-updated past 10861 before October 16, you can relax once you have confirmed the build.

What to do now#

1. Find the exact build in Settings > General, or on the host run curl -s http://127.0.0.1:32400/identity and read the version attribute. Package installs: dpkg-query -W plexmediaserver or rpm -q plexmediaserver.
2. Update to 1.43.3.10861 or later. On Docker, run docker pull plexinc/pms-docker and recreate the container; restarting the old one changes nothing. NAS package centers can lag, and Plex says to install the package manually if yours does.
3. If you don't need outside access, turn off Remote Access and remove any direct port 32400 forward, as Plex advises.
4. Copy the Logs folder before you dig in. The researcher notes PMS keeps only a few log rotations.
5. If you find anything below, follow Plex's cleanup steps: rebuild from a clean install, empty the Codecs folder, check Preferences.xml for unknown transcoder options, sign out all devices, change the Plex password, and rotate credentials for every share the server could reach.

How to tell if you were hit#

The data folder is /var/lib/plexmediaserver/Library/Application Support/Plex Media Server on Linux and /config/Library/Application Support/Plex Media Server in the official container. Call it $PMS:

• grep -o 'TranscoderH264Options="[^"]*"' "$PMS/Preferences.xml". The researcher's hunt script treats a value containing dump-yuv or stats= as a hit, and an empty value as worth review, because the PoC clears the option after use.
• grep -aE 'player/timeline/subscribe|searchOne|sslip\.io|nip\.io' "$PMS/Logs/"*.log. Exploit requests carry a protocol URL pointing at 127.0.0.1:32400/system/agents/.../searchOne. BoredHackerBlog saw them come from 91.92.40.202, 176.65.139.228 and 45.194.92.222 with a Python-urllib/3.10 user agent.
• find "$PMS/Codecs" -type f \( -name '*.so' -o -name '*.dll' \) -newermt 2026-10-16 -ls. Legitimate codec downloads also land here, so look for names you don't recognize.
• Look for processes such as xmrig, myawesomeproxy or mylovelyminer, high CPU while idle, and connections to proxystream.st.

On Linux and Docker hosts, the researcher's read-only plex2shell-hunt.sh automates these checks and includes YARA rules.

Timeline#

• Jul 14, 2026 — PMS 1.43.3.10828 released. It is still vulnerable.
• Jul 27, 2026 — The researcher reports the chain to Plex.
• Aug 3, 2026 — Fixed in PMS 1.43.3.10861 (per The Hacker News).
• Sep 1, 2026 — Plex urges owners of v1.43.2 and earlier to update.
• Sep 23, 2026 — The four CVEs are published.
• Oct 16, 2026 — The Plex2Shell write-up and PoC go public.
• Oct 17, 2026 — First exploitation seen in the wild, dropping a miner and proxyware.
• Oct 19, 2026 — Plex confirms wide exploitation and names 1.43.3.10861 as the first unaffected build.
• Oct 20, 2026 — CISA adds CVE-2026-96652, -96654, -96655 and -96656 to KEV (due Oct 23 and Nov 3).

Vulnerability records

• CVE-2026-96652 · KEV 2026-10-20 · Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
• CVE-2026-96654 · KEV 2026-10-20 · Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions…
• CVE-2026-96655 · KEV 2026-10-20 · Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal'…
• CVE-2026-96656 · KEV 2026-10-20 · Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Plex — Important Security Update for Plex Media Server v1.43.2 and earlier (incl. Oct 19 follow-up) forums.plex.tv
2. CISA — Known Exploited Vulnerabilities: CVE-2026-96656 cisa.gov
3. CVE.org — CVE-2026-96652 record cve.org
4. CVE.org — CVE-2026-96656 record cve.org
5. Zach Main — Plex2Shell write-up zmain.info
6. code-zm/plex2shell — detection scripts and YARA rules github.com
7. Plex — Plex Media Server 1.43.3.10828 release note (Jul 14) forums.plex.tv
8. BoredHackerBlog — Plex vulnerabilities being exploited in the wild boredhackerblog.info

Coverage and analysis

1. The Hacker News — Hackers exploit Plex2Shell flaws thehackernews.com
2. BleepingComputer — Over 36,000 Plex servers unpatched against recently disclosed flaws bleepingcomputer.com