Plex2Shell: four chained Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) widely exploited for miners and proxies

What happened

Researcher Zach Main reported four Plex Media Server flaws to Plex on 27 July 2026. Plex fixed them in 1.43.3.10861, released on 3 August (The Hacker News). On 1 September, Plex asked all server owners to update to 1.43.3 for “a number of security issues” without naming them (Plex).

Chained in order, the four bugs let an unauthenticated attacker run code with the privileges of the Plex process (Plex):

1. CVE-2026-96652: SSRF through /player/timeline. With any X-Plex-Token value, an attacker puts a full URL in the protocol parameter and makes the server POST to it (CVE record).
2. CVE-2026-96654: URL values in searchOne are not neutralised, so an attacker can call other plugins’ functions with their own parameters (CVE record). The Hacker News says this is used to get the owner’s admin token.
3. CVE-2026-96655: with the owner token, SSRF through /video/:/transcode/universal fetches an attacker-hosted file (CVE record).
4. CVE-2026-96656: the TranscoderH264Options preference is appended verbatim to x264’s options on every transcode, which allows writing arbitrary files. At startup, Plex loads every .so file in the Codecs folder without signature, execute-bit or symbol checks (CVE record).

Exploitation started within a day. Technical details went public on 16 October. A researcher known as boredhackerblog recorded attacks the next day (The Hacker News). On 19 October, Plex published the CVEs and said the bugs are “actively and widely exploited” against internet-facing servers that were not updated. Compromised servers run cryptocurrency miners and proxy software (Plex). CISA added all four CVEs to the KEV catalog on 20 October 2026 (CISA KEV).

The payloads seen so far (The Hacker News):

• x12345, a miner fetched with wget or curl by a shell script.
• myawesomeproxy, a Linux backdoor and reverse proxy.
• mylovelyminer, an XMRig miner pointed at ota.proxystream[.]st. Bitsight linked global.relay.proxystream[.]st to the AISURU DDoS and proxyware botnet in August 2026.

Am I affected?

Every Plex Media Server before 1.43.3.10861 is affected. In Plex Web, open Settings > General to see the version (Plex). From the server itself:

curl -s http://127.0.0.1:32400/identity

The version attribute in the reply is the server version. NAS package managers may lag behind; Plex notes a manual install may be needed.

Check for compromise. Plex lists these signs:

• Processes started by Plex Media Server that you do not recognise, such as myawesomeproxy, mylovelyminer or x12345.
• Unfamiliar .so or .dll files in the Plex Codecs folder.
• Outbound connections to proxystream.st.
• Sustained high CPU while nothing is playing.

On a Linux package install:

ps -eo pid,user,etime,args | grep -E 'myawesomeproxy|mylovelyminer|x12345' | grep -v grep

PMS="/var/lib/plexmediaserver/Library/Application Support/Plex Media Server"
ls -la --time-style=full-iso "$PMS/Codecs"
find "$PMS/Codecs" -name '*.so' -newermt 2026-10-15 -ls
grep -o 'TranscoderH264Options="[^"]*"' "$PMS/Preferences.xml"

Any TranscoderH264Options value you did not set yourself is a strong sign of this exploit. Docker and NAS installs keep the same folder under their own data path.

Network indicators from The Hacker News: attacking IPs 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222; payload host 217.60.194[.]116; SHA-256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 (x12345) and e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 (myawesomeproxy).

What to do now

1. Update to 1.43.3.10861 or later. On Windows and macOS use automatic updates or the Downloads page; on Linux install the new .deb or .rpm; on Docker follow the pms-docker instructions; on NAS devices install the package manually if the store is behind (Plex).
2. If you find any sign of compromise, or cannot rule it out, Plex says to rebuild from a clean install rather than reuse the old data directory. At minimum, delete everything in the Codecs folder and remove transcoder options you did not set in Preferences.xml.
3. Sign out all devices and change your Plex password. Plex lists both as cleanup steps, because the chain steals the owner’s token.
4. Treat whatever the Plex account could reach as exposed: mounted shares, and credentials stored on the same machine or VM.
5. Reduce exposure. If you do not need it, turn off Settings > Remote Access, and avoid forwarding port 32400 directly.
6. Block and search for the IPs and proxystream.st domains above in router, firewall or DNS logs from 16 October onward.

Sources

• Plex forum: important security update for Plex Media Server 1.43.2 and earlier (CVE details 19 October 2026)
• The Hacker News: hackers exploit Plex2Shell flaws
• CVE record: CVE-2026-96652
• CVE record: CVE-2026-96654
• CVE record: CVE-2026-96655
• CVE record: CVE-2026-96656
• CISA Known Exploited Vulnerabilities catalog