{"id":"plex-plex2shell-server-attacks-oct-2026","category":"patch","status":"live","title":"Plex2Shell attacks hijack Plex Media Server for cryptocurrency mining and proxy traffic","tldr":"Plex2Shell attacks target internet-accessible Plex Media Servers, installing miners and routing strangers’ traffic through victims’ connections. Update to 1.43.3.10861 or later; an already compromised server also needs cleaning or rebuilding.","summary":"Plex2Shell combines four Plex Media Server flaws so a remote attacker can run code without first signing in. It affects servers before 1.43.3.10861, including installations on home computers and NAS storage devices. The flaws include making Plex contact addresses inside or outside the home network, accessing internal functions and writing files that can execute. A researcher observed mining and proxy software on 17 October; Plex confirmed widespread attacks on 19 October. All four flaws are fixed in 1.43.3.10861 and later, with manual packages available where NAS update stores lag. Updating does not establish that an already attacked server is clean. As at 3 November, the reviewed sources contain no all-clear or confirmed total of compromised servers.","action":"In Plex Web, open Settings → General and update Plex Media Server to 1.43.3.10861 or later; use Plex’s manual NAS package if needed. If an older server was internet-accessible, ask whoever maintains it to check for compromise and rebuild it cleanly if that cannot be ruled out, then sign out all Plex devices and change your password. Turn off Settings → Remote Access if you do not need it.","product":"Plex Media Server","audience":"home","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656"],"tags":["plex","plex-media-server","plex2shell","nas","actively-exploited","cryptomining"],"affected":["Plex Media Server versions before 1.43.3.10861"],"fixed":["Plex Media Server 1.43.3.10861 and later"],"matches":[{"platform":"windows","app":"Plex Media Server","bundle":"","fixed":"1.43.3.10861"},{"platform":"macos","app":"Plex Media Server","bundle":"","fixed":"1.43.3.10861"},{"platform":"linux","app":"Plex Media Server","bundle":"plexmediaserver","fixed":"1.43.3.10861"},{"platform":"nas","app":"Plex Media Server","bundle":"","fixed":"1.43.3.10861"},{"platform":"android","app":"Plex Media Server","bundle":"","fixed":"1.43.3.10861"}],"sources":[{"kind":"advisory","title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/1","by":"Plex","date":"2026-10-19"},{"kind":"advisory","title":"Plex Media Server — VA-26-266-01","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","by":"CISA","date":"2026-09-23"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"news","title":"CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","by":"BleepingComputer","date":"2026-10-21"},{"kind":"research","title":"Plex vulnerabilities being exploited in the wild to drop a cryptominer","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","by":"BoredHackerBlog","date":"2026-10-17"},{"kind":"research","title":"Plex2Shell: Plex Media Server Exploit Chain SSRF to Arbitrary Code Execution","url":"https://www.sonicwall.com/blog/plex2shell-plex-media-server-exploit-chain-ssrf-to-arbitrary-code-execution","by":"SonicWall","date":"2026-10-29"}],"started":"2026-10-17","closed":null,"created":"2026-11-03T21:54:08.482Z","updated":"2026-11-03T21:54:08.482Z","cve_notes":[{"cve":"CVE-2026-96652","name":"Request forgery in Plex’s player timeline","what":"A flaw in Plex Media Server’s player timeline lets an unauthenticated attacker make the server send requests to destinations they choose, including internal services.","severity":"medium","cvss":4.3},{"cve":"CVE-2026-96654","name":"URL injection in Plex’s internal plugin functions","what":"Faulty URL handling in Plex Media Server’s searchOne function lets an attacker invoke other plugins’ functions with values they control.","severity":"medium","cvss":6.5},{"cve":"CVE-2026-96655","name":"Request forgery in Plex’s media transcoder","what":"A request-forgery flaw in Plex Media Server’s transcoder lets an authenticated user contact internal or external addresses, with Plex identifying owner admin-token disclosure as its role in the chain.","severity":"medium","cvss":4.3},{"cve":"CVE-2026-96656","name":"Executable file writing through Plex transcoder settings","what":"A flaw in Plex Media Server’s transcoder preferences lets an administrator write attacker-chosen files that Plex can load and execute.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-10-29","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"SonicWall published its analysis and announced three intrusion-prevention signatures covering the request-forgery, URL-handling and file-writing flaws.","url":"https://www.sonicwall.com/blog/plex2shell-plex-media-server-exploit-chain-ssrf-to-arbitrary-code-execution","by":"SonicWall","patch":null},{"at":"2026-10-20","added":"2026-11-03T21:45:10.669Z","kind":"cisa-added","text":"CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalogue.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-10-19","added":"2026-11-03T21:45:10.669Z","kind":"vendor-revised","text":"Plex confirmed widespread exploitation and named all four CVEs. It advised rebuilding servers where compromise could not be ruled out.","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/1","by":"Plex","patch":null},{"at":"2026-10-17","added":"2026-11-03T21:45:10.669Z","kind":"wider-attacks","text":"BoredHackerBlog observed attacks against a deliberately exposed test server, downloading a cryptocurrency miner. An update that day reported proxy software too.","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","by":"BoredHackerBlog","patch":null},{"at":"2026-09-23","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"CISA published detailed descriptions of the flaws and identified 1.43.3.10861 as the fixed Plex Media Server version.","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","by":"CISA","patch":null},{"at":"2026-09-01","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"Plex announced security updates and urged owners to update. It provided manual installation instructions for NAS devices whose package managers might lag.","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319/1","by":"Plex","patch":"patched"},{"at":"2026-07-27","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Researcher Zach Main privately reported the vulnerabilities to Plex, according to BleepingComputer.","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/plex-plex2shell-server-attacks-oct-2026/","json":"https://hard.fyi/api/live?id=plex-plex2shell-server-attacks-oct-2026"}