Plex2Shell: update Plex Media Server, then check for miners
Plex2Shell chains four Plex Media Server flaws into remote code execution. CISA lists it as exploited. Update to 1.43.3.10861 and check the box for implants.
Plex2Shell is four Plex Media Server bugs chained into unauthenticated remote code execution, and attackers are using it now. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on October 20. The fix shipped in August. That gap is the story: the patch was out for two months, and servers that never took it are getting cryptominers and proxy backdoors this week.
What actually happened
Per CISA's alert, the four entries are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. BleepingComputer and The Hacker News describe how the chain works:
- An unauthenticated SSRF in
/player/timelinemakes the server send requests to its own internal APIs - A URL injection in
searchOneis used to pull the owner's admin token - With that token, a second SSRF and an arbitrary file write drop a malicious shared library into the Codecs directory, which Plex then loads and runs
Researcher Zach Main reported the bugs to Plex on July 27. Plex fixed them in Plex Media Server 1.43.3.10861, released in early August. Main published full details on October 16. Exploitation started within days. The payloads reported so far are an XMRig miner and a Linux reverse-proxy backdoor. CISA gave federal agencies until October 23 to patch.
Why it matters for your business
Plex is not "enterprise software," so it never makes the patch list. That is the problem. In a small company it runs on the NAS in the back room, the old desktop that plays the lobby TV, or the owner's home server that is on the same VPN as the office. It sits outside every patch policy, and the owner forwarded its port to the internet years ago.
A cryptominer on that box costs you power and performance. A reverse proxy is worse: your IP address becomes someone else's exit node, and your network is now a pivot point.
Updating closes the chain. It does not remove a library that is already in the Codecs folder, and it does not cancel an admin token that was already stolen. If your server was reachable from the internet on an old build, treat it as suspect until you check it.
Key takeaways
- Plex2Shell chains CVE-2026-96652, -96654, -96655 and -96656 into unauthenticated code execution
- CISA added all four to its KEV catalog on October 20, with an October 23 federal deadline
- The fix is Plex Media Server 1.43.3.10861 or later; check the full build number, not just "1.43.3"
- Reported payloads include an XMRig miner and a Linux proxy backdoor
- After you update, check the Codecs directory for unknown files, reset the Plex account password, and close the port forward if you do not need remote access
The box that gets you breached is the one nobody owns. We inventory every device on a small-business network, including the media server and the NAS, and give each one a named patch owner. Send us your device list or see how we scope it.
Sources: CISA, BleepingComputer, The Hacker News.
- #plex
- #plex2shell
- #cisa-kev
- #cryptominer
- #patch-management
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Copilot usage metrics API now names your MCP servers and agents
GitHub's Copilot usage metrics API now reports MCP servers, custom agents and skills by name, not as 'other'. Use it to audit what your AI coding fleet runs.
Read itBeyondTrust CVE-2026-102764: patched is not the same as clean
BeyondTrust Remote Support zero-day CVE-2026-102764 was exploited from August. The patch closes the hole; it does not remove root access an attacker already got.
Read it