Who Else Is Watching That Plex Server?

On October 16, 2026, a researcher published a working exploit for Plex Media Server. By October 17, a honeypot was already watching strangers use it to install crypto miners.

That gap of one day is the story. The software is the one people run to stream movies from a closet NAS, a spare office PC or a home lab. Nobody treats it as critical infrastructure. Attackers don't care what it was bought for, only that it answers on the internet and runs code when asked nicely.

TL;DR

Plex2Shell is a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) that together give an unauthenticated attacker remote code execution on servers older than version 1.43.3.10861. Attackers began exploiting the chain on October 17, 2026, a day after the proof of concept went public, to deploy a Monero miner and a Linux proxy backdoor. CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026. Update every Plex Media Server to 1.43.3.10861 or later, take port 32400 off the open internet, and check updated servers for miner and proxy processes, because patching does not remove a payload that is already installed.

What is Plex2Shell?

Plex2Shell is the name security researcher Zach Main gave to four chained Plex Media Server bugs that, combined, let someone with no account run their own code on the server. Main reported them to Plex on July 27, 2026, and Plex fixed them in Plex Media Server 1.43.3.10861, according to The Hacker News.

None of the four looks alarming on its own. Their CVSS scores, the 0-to-10 severity scale, are 5.3, 6.9, 5.3 and 8.6. That's what makes the chain interesting: it is four medium-sized keys that together open the whole house.

Here is the chain in plain words:

1. CVE-2026-96652 (CVSS 5.3), unauthenticated SSRF. Server-side request forgery means tricking a server into making web requests for you. A protocol value on the /player/timeline endpoint isn't checked, so an attacker can make Plex send requests wherever they choose.
2. CVE-2026-96654 (CVSS 6.9), unsanitised URL values in searchOne. This bug lets the attacker call other plugins' functions with their own parameters and walk away with the server owner's admin token, the digital equivalent of the landlord's master key.
3. CVE-2026-96655 (CVSS 5.3), authenticated SSRF. Holding the owner token, the attacker uses the /video/:/transcode/universal path to make Plex fetch a "video" from the attacker's server. That video carries a malicious Linux program.
4. CVE-2026-96656 (CVSS 8.6), attacker-controlled file path. Plex then writes that program, a shared library, into its own Codecs folder and runs it. Game over.

Is Plex2Shell being exploited?

Yes. Exploitation of Plex2Shell began on October 17, 2026, one day after the public write-up, and CISA has confirmed it by listing all four CVEs in its KEV catalog. A honeypot run by the researcher behind BoredHackerBlog caught the attacks, SecurityOnline reported.

What the attackers installed is revealing:

• x12345 / mylovelyminer, an XMRig cryptocurrency miner that points at ota.proxystream[.]st. Your client pays the electricity bill and someone else gets the Monero.
• myawesomeproxy, which VirusTotal describes as a stealthy Linux backdoor and reverse proxy. It turns the victim's internet connection into an exit point that strangers rent to hide their own traffic. A related domain, global.relay.proxystream[.]st, was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet, per The Hacker News.

A proxy on a client's network is worse than it sounds. When someone else's fraud or scanning traffic leaves from your client's office IP address, the abuse reports, blocklists and awkward letters land on your client.

US federal agencies must fix CVE-2026-96654 and CVE-2026-96656 by October 23, 2026, and the two SSRF flaws by November 3, 2026. Those deadlines bind federal agencies only, but they're a useful yardstick for everyone else.

Why should an MSP care about a movie server?

Because a forgotten media server is a fully working Linux or Windows computer on the network, and Plex has been the way into a serious breach before. In 2022, attackers got into a LastPass DevOps engineer's home computer through an old, unpatched Plex Media Server (CVE-2020-5741). They planted a keylogger, captured the engineer's credentials and used them to reach the company's cloud storage, The Hacker News reported in March 2023. Plex said the engineer had "never upgraded" a version patched in May 2020.

Plex2Shell is a different bug, but the lesson carries over. Plex shows up in places nobody inventories:

• The small-office NAS, where a Synology or QNAP box got the Plex package "for the waiting-room TV."
• The owner's spare PC, which also has the accounting share mapped.
• Port forwards someone set up years ago so they could stream from a hotel, and never removed.

Plex itself emailed affected users in early September 2026 urging them to update. Every server that ignored that email is now a target with a public exploit pointed at it.

Am I affected? How to check your clients for Plex2Shell

A client is exposed if they run Plex Media Server older than 1.43.3.10861 and its port (32400 by default) is reachable by an attacker. Work through it in this order:

1. Find every Plex instance. Scan each client's external IP ranges for TCP 32400 and for anything identifying itself as Plex, then ask the awkward question internally: "Does anyone run Plex on a NAS, a PC or a Docker host here?"
2. Check the version. The server's web interface shows it under Settings → General. Anything below 1.43.3.10861 is vulnerable.
3. Look for the payloads before you assume you're clean. On any server that was vulnerable while exposed, look for processes named x12345, mylovelyminer or myawesomeproxy. Check for unexpected files in the Plex Codecs folder, unknown Docker containers, sustained high CPU, and outbound connections to proxystream[.]st. Check firewall logs for the attack sources SecurityOnline listed: 45.194.92.222, 91.92.40.202 and 176.65.139.228, plus the payload host 217.60.194.116.

How do I fix Plex2Shell?

Update Plex Media Server to 1.43.3.10861 or later, then stop exposing it directly to the internet. On NAS devices the package manager may lag behind, so install the package manually if the store doesn't offer the new build yet.

Then:

• Remove the port forward. Plex's own relay or a VPN covers remote viewing without leaving 32400 open to every scanner on earth.
• If you found a payload, rebuild, don't just patch. The update closes the door; it doesn't evict anyone already inside. Kill the processes, remove persistence, rotate the Plex account password and any credentials stored on that box, and consider reinstalling the host.
• Separate it. A media server belongs on a guest or IoT network segment, not next to file shares and domain controllers.
• Put it on the patch list. "Hobby" software on business hardware has to go into the same update routine as everything else.

Where KinoSec fits

Plex2Shell is a textbook case of something your clients' patch reports never mention. Nobody asset-tagged the Plex box, so nobody patched it, and it answers on a port nobody remembers opening.

That's the gap an external network pentest exists to close. KinoSec runs an autonomous external pentest across each client's internet-facing ranges: it finds what is actually listening, including the stray media server on 32400, works out what that service is and which version it runs, and tests whether known weaknesses really work. It also chains small findings together, the same way Plex2Shell turns four medium bugs into code execution. Each finding comes with a severity and remediation steps, in a report you can hand straight to your client.

One honest line worth drawing: what the Plex2Shell crews did is an attack. A pentest is the same reconnaissance, run with your client's permission, scope limits and a report they can act on. And scope cuts both ways. KinoSec tests the networks your client authorises, so an employee's home Plex server, like the one in the LastPass breach, needs a policy and a VPN rule rather than a scan. Within scope, running it monthly means the next "nobody knew that was there" turns up in your report before it turns up on a honeypot.

Frequently Asked Questions

What is Plex2Shell?

Plex2Shell is a chain of four Plex Media Server vulnerabilities, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, discovered by researcher Zach Main. Chained together, they let an attacker with no account steal the server owner's admin token, make Plex download a malicious file and run it. It affects Plex Media Server versions before 1.43.3.10861.

How do I check if my clients were hit by Plex2Shell?

First, find every Plex Media Server on each client's network and confirm its version in Settings → General; anything below 1.43.3.10861 was vulnerable. Second, on those hosts, look for processes named x12345, mylovelyminer or myawesomeproxy, unexpected files in the Plex Codecs folder, and unknown Docker containers. Third, check firewall logs for connections to proxystream[.]st or to the attack IPs 45.194.92.222, 91.92.40.202 and 176.65.139.228.

How do I fix the Plex Media Server vulnerabilities?

Update Plex Media Server to version 1.43.3.10861 or later, installing the package manually on NAS devices if the app store lags. Close any port forward for TCP 32400 and use Plex's relay or a VPN for remote access instead. If a server was compromised, patching alone is not enough: remove the malware, rotate credentials stored on the host, and consider rebuilding it.

Is Plex2Shell on the CISA KEV list?

Yes. CISA added all four Plex2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 20, 2026, after attackers began exploiting the chain on October 17, 2026. Federal agencies must patch CVE-2026-96654 and CVE-2026-96656 by October 23, 2026 and the two SSRF flaws by November 3, 2026.

Can an autonomous pentest find an exposed Plex server?

Yes, if the server is inside the authorised scope. An autonomous external pentest such as KinoSec scans a client's internet-facing IP ranges, identifies services like Plex Media Server on port 32400, checks their versions against known vulnerabilities and reports each finding with remediation steps. Servers on employees' home networks fall outside a client's scope and need policy controls instead.