NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

Plex2Shell attacks hijack Plex Media Server for cryptocurrency mining and proxy traffic

Plex2Shell attacks target internet-accessible Plex Media Servers, installing miners and routing strangers’ traffic through victims’ connections. Update to 1.43.3.10861 or later; an already compromised server also needs cleaning or rebuilding.

What to do

In Plex Web, open Settings → General and update Plex Media Server to 1.43.3.10861 or later; use Plex’s manual NAS package if needed. If an older server was internet-accessible, ask whoever maintains it to check for compromise and rebuild it cleanly if that cannot be ruled out, then sign out all Plex devices and change your password. Turn off Settings → Remote Access if you do not need it.

Check your devices
  • Plex Media Serverfixed in 1.43.3.10861 and later
  • Plex Media Serverfixed in 1.43.3.10861 and later
  • Plex Media Serverfixed in 1.43.3.10861 and later
  • Plex Media Serverfixed in 1.43.3.10861 and later
  • Plex Media Serverfixed in 1.43.3.10861 and later

What’s happening

Plex2Shell combines four Plex Media Server flaws so a remote attacker can run code without first signing in. It affects servers before 1.43.3.10861, including installations on home computers and NAS storage devices. The flaws include making Plex contact addresses inside or outside the home network, accessing internal functions and writing files that can execute. A researcher observed mining and proxy software on 17 October; Plex confirmed widespread attacks on 19 October. All four flaws are fixed in 1.43.3.10861 and later, with manual packages available where NAS update stores lag. Updating does not establish that an already attacked server is clean. As at 3 November, the reviewed sources contain no all-clear or confirmed total of compromised servers.

What
Flaw
Affects
Plex Media Server
Affected
Plex Media Server versions before 1.43.3.10861
Fixed in
Plex Media Server 1.43.3.10861 and later
CVE
CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Since
17 Oct 2026

Timeline

  1. Update

    SonicWall published its analysis and announced three intrusion-prevention signatures covering the request-forgery, URL-handling and file-writing flaws.

  2. CISA added

    CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalogue.

  3. Vendor revised

    Plex confirmed widespread exploitation and named all four CVEs. It advised rebuilding servers where compromise could not be ruled out.

  4. Wider attacks

    BoredHackerBlog observed attacks against a deliberately exposed test server, downloading a cryptocurrency miner. An update that day reported proxy software too.

  5. Update

    CISA published detailed descriptions of the flaws and identified 1.43.3.10861 as the fixed Plex Media Server version.

  6. Made publicFixed

    Plex announced security updates and urged owners to update. It provided manual installation instructions for NAS devices whose package managers might lag.

  7. Update

    Researcher Zach Main privately reported the vulnerabilities to Plex, according to BleepingComputer.

Sources

  1. Important Security Update for Plex Media Server v1.43.2 and earlierPlex · 19 Oct 2026
  2. Plex Media Server — VA-26-266-01CISA · 23 Sept 2026
  3. Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026
  4. CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach serversBleepingComputer · 21 Oct 2026
  5. Plex vulnerabilities being exploited in the wild to drop a cryptominerBoredHackerBlog · 17 Oct 2026
  6. Plex2Shell: Plex Media Server Exploit Chain SSRF to Arbitrary Code ExecutionSonicWall · 29 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS