If you run Plex Media Server at home, stop what you’re doing and check your version. A four-bug chain called Plex2Shell is being used in the wild to take over servers without a login.
What’s going on
- The bugs are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together they give remote code execution as the Plex service, no credentials needed.
- Plex was told back in July and shipped fixes; its September 1 advisory told everyone to update.
- The researcher published a write-up and working exploit on October 16. By the morning of October 17, a honeypot running an old Plex build was hit and loaded with an XMRig crypto miner, then a residential proxy tool that rents out your internet connection.
What to do
- Update the server to 1.43.3.10861 or newer (1.43.4.10903 is current). Note that 1.43.3.10828 is still vulnerable, so “1.43.3” isn’t enough.
- Docker folks: pinned image tags never update themselves. Pull a new image and recreate the container.
- If you only watch at home, turn off Remote Access and remove the port 32400 forward on your router. Use a VPN if you need it on the road.
- Look for trouble: constant high CPU, processes running as the plex user that aren’t Plex, odd files in the Codecs folder, or steady upload traffic when nobody’s streaming.
My take
Hours from public exploit to real attacks. That’s the world now. Anything you expose to the internet needs to be patched fast or not exposed at all, and that goes double for homelab boxes that sit on a residential IP.
Have a blessed day! And Happy Hacking!
References & Further Reading
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure (SecurityWeek)
- Plex vulnerabilities being exploited in the wild to drop a cryptominer (boredhackerblog)
- Important Security Update for Plex Media Server (Plex Forums)
- Plex2Shell: what home users should do (ctxsec)
- CVE-2026-96652 (CVE.org)
