Plex2Shell Exploit Chain Hits Plex Media Servers
A Home Media Server Turns Into a Botnet Node
An ordinary home media server can become a tool for cryptocurrency mining and for hidden relaying of other people’s traffic. Researchers found a chain of four flaws in Plex Media Server, named Plex2Shell. Together, they let attackers run arbitrary code remotely, with no login.
Plex has confirmed mass attacks, and Censys counts almost 100,000 potentially vulnerable servers.
How Many Servers Are Exposed
According to an analysis from Censys published on October 20, 323,583 Plex Media Server instances face the internet. About 30 percent run vulnerable versions, and roughly 44 percent of all the servers sit in the United States.
One more detail matters. Nearly 8,000 servers run the early build 1.43.3.10828. Their owners may wrongly believe those servers are patched.
The Four-Step Exploit Chain
Each flaw looks less dangerous alone than the whole chain does. The steps run in this order:
- CVE-2026-96652 (CVSS 3.1: 4.3): lets an attacker make the server send requests to a chosen address.
- CVE-2026-96654 (CVSS 3.1: 6.5): gives access to internal Plex functions.
- CVE-2026-96655 (CVSS 3.1: 4.3): reveals the owner’s administrator token.
- CVE-2026-96656 (CVSS 3.1: 7.2): allows code execution, as the next section explains.
From Admin Token to Code Execution
The stolen rights open the door to CVE-2026-96656. Through the video transcoding settings, the attacker writes a malicious library into the Codecs directory. Plex loads the file without checking its digital signature. Then it runs the code with the privileges of the server process.
Attacks Began Within Days
A working exploit appeared on October 16. On October 17, a honeypot recorded the first attack. The attacker installed a miner and a proxy program on the compromised server.
Plex later confirmed widespread exploitation. The proxy reroutes outside internet traffic through the victim’s connection. In effect, it turns a home server into someone else’s network node.
A Patch Months Old, Slow to Spread
Plex shipped the fixed version, 1.43.3.10861, on August 4. On September 1, it warned owners to update. Even so, the situation barely changed after the exploit went public.
In the first three days, fewer than 2 percent of the remaining vulnerable servers updated. Censys also found that only about 40 percent of vulnerable installs tracked by their earlier IP addresses had received the update.
What Owners Should Do
Updating an already hacked server does not remove the malicious libraries. It also does not revoke stolen tokens. Plex advises owners of possibly compromised installs to take these steps:
- Reinstall Plex.
- Clear the Codecs directory.
- Check the transcoding settings.
- End all sessions and change the password.
Network shares and credentials that the server process can reach are also at risk.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
