---
title: "Plex2Shell: Exploited RCE Chain in Plex Media Server"
url: https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/
description: "Plex Media Server before 1.43.3.10861 is exploited via the Plex2Shell chain to drop miners and proxyware. Update now and check for compromise."
type: security-brief
section: "Security Digest"
date_published: 2026-10-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-96652", "CVE-2026-96654", "CVE-2026-96655", "CVE-2026-96656"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Plex2Shell: Exploited RCE Chain in Plex Media Server

**Verdict: Act now.** A public proof of concept chains four Plex bugs into code execution without credentials, and attackers have used it since October 17: update any internet-reachable server now, then check it for a miner or proxy.

- **Who must act:** Anyone running Plex Media Server older than 1.43.3.10861 that is reachable from the internet, including NAS and Docker installs.
- **Who can relax:** Servers already on 1.43.3.10861 or later; LAN-only servers are far less exposed but should still update.
- **Affected:** Plex Media Server before 1.43.3.10861 (all platforms); Plex Media Server 1.43.3.10828 and other 1.43.3 builds before 10861
- **Fixed:** Plex Media Server 1.43.3.10861 and later
- **CVEs:** CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the full build number in Settings > General, or run curl -s http://127.0.0.1:32400/identity on the server.
2. Update to Plex Media Server 1.43.3.10861 or later; on Docker, pull plexinc/pms-docker and recreate the container.
3. Turn off Remote Access and remove any port 32400 forward if you do not need outside access.
4. Preserve the Plex logs, then check Preferences.xml, the Codecs folder and outbound traffic for the indicators below.
5. If anything turns up, rebuild from a clean install, sign out all devices, change the Plex password and rotate credentials for shares the server could reach.

### How to check if you are affected

- Preferences.xml containing a TranscoderH264Options value with dump-yuv or stats= (an empty value is also worth a look).
- Plex logs showing /player/timeline/subscribe requests with a protocol URL, searchOne calls with /function/ in the identifier, or sslip.io / nip.io hostnames.
- Unfamiliar .so or .dll files in the Codecs folder, or processes such as xmrig or myawesomeproxy running as the plex user.
- Outbound connections to proxystream.st, downloads from 217.60.194.116, or high CPU while the server is idle.
- Run the researcher's read-only plex2shell-hunt.sh triage script on Linux and Docker hosts.

## What happened

On October 16, 2026, researcher Zach Main published [Plex2Shell](https://zmain.info/blog/plex2shell), a write-up and proof of concept that chains four Plex Media Server (PMS) bugs into code execution without any credentials. The next morning a honeypot run by [BoredHackerBlog](https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html) recorded the first exploitation in the wild. On October 19 Plex said in its [security thread](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319) that the flaws are "actively and widely exploited." On October 20 CISA added all four CVEs to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656).

The chain, as the researcher describes it:

- **CVE-2026-96652:** `/player/timeline` checks only that an `X-Plex-Token` header exists, not that it is valid. A crafted `protocol` parameter makes the server POST to any URL, including its own loopback interface ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96652)).
- **CVE-2026-96654:** loopback requests skip authentication on the internal `/system/agents` API, and `searchOne` does not neutralize URL values, so the attacker can call other plugins' functions.
- **Owner token theft:** PMS attaches the owner's admin token to outbound requests whose URL starts with `http://127.0.0.1`. Because that is a prefix match, a hostname like `127.0.0.1.<attacker>.sslip.io` receives the token.
- **CVE-2026-96656:** with that token, the attacker sets the `TranscoderH264Options` preference, which PMS appends verbatim to x264's options, and triggers a transcode that writes a shared object into the Codecs folder. PMS loads every `.so` there at startup without signature checks ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-96656)), so the code runs as the `plex` user.

The fourth CVE, CVE-2026-96655, is an authenticated SSRF in `/video/:/transcode/universal`. CISA, acting as CNA, scores the bugs individually from 4.3 to 7.2 on CVSS 3.1 (8.6 on CVSS 4.0 for the file write). The researcher scores the full chain at 9.8.

## Who is affected

Every PMS build older than **1.43.3.10861**, on Windows, macOS, Linux, NAS packages and Docker. The [Hacker News](https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html) reports that the fix shipped on August 3. One trap: Plex's September 1 notice told users to move to "1.43.3," but the [1.43.3.10828 build](https://forums.plex.tv/t/plex-media-server/30447/711) released July 14 predates the fix. Check the full build number, not the first three digits. Plex now says any server older than 10861 that is reachable from the internet should be presumed possibly compromised.

Plenty of servers update slowly. In September, Shadowserver counted more than 36,000 internet-exposed PMS instances still unpatched against Plex's earlier advisory ([BleepingComputer](https://www.bleepingcomputer.com/news/security/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws/)).

## Do you really need to act?

**Yes, today, if the server is reachable from the internet.** The chain needs no account, a working exploit is public, and CISA set an October 23 deadline for two of the four CVEs. What attackers install so far is a money-maker, not ransomware. BoredHackerBlog captured an XMRig miner and a tool called `myawesomeproxy`, fetched from `217.60.194.116`. The proxy's startup banner says it may make "external use of your internet traffic." The Hacker News reports the miner talks to `ota.proxystream[.]st`, and that Bitsight tied another proxystream subdomain to the AISURU DDoS and proxyware botnet. A home Plex box on a residential IP is exactly what proxyware operators want. Code running as `plex` can also read your media libraries and any shares the server mounts, which is why Plex says to treat those credentials as exposed.

LAN-only servers are much less exposed, but the chain works from any device that can reach port 32400, so update them anyway. If your server auto-updated past 10861 before October 16, you can relax once you have confirmed the build.

## What to do now

1. Find the exact build in Settings > General, or on the host run `curl -s http://127.0.0.1:32400/identity` and read the `version` attribute. Package installs: `dpkg-query -W plexmediaserver` or `rpm -q plexmediaserver`.
2. Update to 1.43.3.10861 or later. On Docker, run `docker pull plexinc/pms-docker` and recreate the container; restarting the old one changes nothing. NAS package centers can lag, and Plex says to install the package manually if yours does.
3. If you don't need outside access, turn off Remote Access and remove any direct port 32400 forward, as Plex advises.
4. Copy the `Logs` folder before you dig in. The researcher notes PMS keeps only a few log rotations.
5. If you find anything below, follow Plex's cleanup steps: rebuild from a clean install, empty the Codecs folder, check `Preferences.xml` for unknown transcoder options, sign out all devices, change the Plex password, and rotate credentials for every share the server could reach.

## How to tell if you were hit

The data folder is `/var/lib/plexmediaserver/Library/Application Support/Plex Media Server` on Linux and `/config/Library/Application Support/Plex Media Server` in the official container. Call it `$PMS`:

- `grep -o 'TranscoderH264Options="[^"]*"' "$PMS/Preferences.xml"`. The researcher's hunt script treats a value containing `dump-yuv` or `stats=` as a hit, and an empty value as worth review, because the PoC clears the option after use.
- `grep -aE 'player/timeline/subscribe|searchOne|sslip\.io|nip\.io' "$PMS/Logs/"*.log`. Exploit requests carry a `protocol` URL pointing at `127.0.0.1:32400/system/agents/.../searchOne`. BoredHackerBlog saw them come from `91.92.40.202`, `176.65.139.228` and `45.194.92.222` with a `Python-urllib/3.10` user agent.
- `find "$PMS/Codecs" -type f \( -name '*.so' -o -name '*.dll' \) -newermt 2026-10-16 -ls`. Legitimate codec downloads also land here, so look for names you don't recognize.
- Look for processes such as `xmrig`, `myawesomeproxy` or `mylovelyminer`, high CPU while idle, and connections to `proxystream.st`.

On Linux and Docker hosts, the researcher's read-only [plex2shell-hunt.sh](https://github.com/code-zm/plex2shell/tree/main/detection) automates these checks and includes YARA rules.

## Timeline

- Jul 14, 2026 — PMS 1.43.3.10828 released. It is still vulnerable.
- Jul 27, 2026 — The researcher reports the chain to Plex.
- Aug 3, 2026 — Fixed in PMS 1.43.3.10861 (per The Hacker News).
- Sep 1, 2026 — Plex urges owners of v1.43.2 and earlier to update.
- Sep 23, 2026 — The four CVEs are published.
- Oct 16, 2026 — The Plex2Shell write-up and PoC go public.
- Oct 17, 2026 — First exploitation seen in the wild, dropping a miner and proxyware.
- Oct 19, 2026 — Plex confirms wide exploitation and names 1.43.3.10861 as the first unaffected build.
- Oct 20, 2026 — CISA adds CVE-2026-96652, -96654, -96655 and -96656 to KEV (due Oct 23 and Nov 3).

## Sources

1. [Plex — Important Security Update for Plex Media Server v1.43.2 and earlier (incl. Oct 19 follow-up)](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319)
2. [CISA — Known Exploited Vulnerabilities: CVE-2026-96656](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656)
3. [CVE.org — CVE-2026-96652 record](https://www.cve.org/CVERecord?id=CVE-2026-96652)
4. [CVE.org — CVE-2026-96656 record](https://www.cve.org/CVERecord?id=CVE-2026-96656)
5. [Zach Main — Plex2Shell write-up](https://zmain.info/blog/plex2shell)
6. [code-zm/plex2shell — detection scripts and YARA rules](https://github.com/code-zm/plex2shell/tree/main/detection)
7. [Plex — Plex Media Server 1.43.3.10828 release note (Jul 14)](https://forums.plex.tv/t/plex-media-server/30447/711)
8. [BoredHackerBlog — Plex vulnerabilities being exploited in the wild](https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
9. [The Hacker News — Hackers exploit Plex2Shell flaws](https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html)
10. [BleepingComputer — Over 36,000 Plex servers unpatched against recently disclosed flaws](https://www.bleepingcomputer.com/news/security/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws/)

---
Source page: https://erroneo.us/security/briefs/plex2shell-plex-media-server-rce-chain/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt