Plex2Shell exploit chain hits unpatched Plex servers a day after PoC release

Attackers have started exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server that allows code execution on exposed servers without valid credentials, SecurityWeek reported on October 19. Exploitation was observed on October 17, just one day after the researcher who found the flaws published a technical write-up and proof-of-concept code. Plex released fixes in early September, so the attacks hit servers that have not been updated.

What happened

According to SecurityWeek, the chain combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, the bugs let an attacker execute arbitrary code on an internet-facing Plex Media Server, with the same privileges as the Plex service.

The publication outlined the disclosure timeline: the researcher reported the issues to Plex on July 27, Plex confirmed them on August 4 and awarded a bug bounty, and on September 1 the company announced fixes and asked server owners to upgrade. The write-up and PoC followed on October 16.

A separate researcher running an internet-facing Plex honeypot on a vulnerable release told SecurityWeek that the system had mostly attracted reconnaissance scans and generic attacks until the morning of October 17, when real exploitation appeared. The attackers appear to have used the public exploit, possibly with modifications.

Technical details

SecurityWeek reported that the attackers first deployed an XMRig-based cryptocurrency miner on the honeypot. Later the same day, a proxy program called myawesomeproxy showed up; the tool displays a notice saying users agree that their internet traffic may be used.

The researcher warned that the proxy element could be more dangerous than the miner. Because many Plex servers run on home connections, a compromised server can give attackers a residential IP address, which threat actors value for reaching corporate VPNs and email services without raising suspicion. The researcher also cautioned that the published indicators of compromise only reflect what one honeypot saw, so other attackers may be using different payloads.

Who is affected

Plex's own security notice, published on its forums on September 1, states that Plex Media Server v1.43.2 and earlier are affected and that the fixes are in Plex Media Server 1.43.3, with a related fix in Plex Desktop 1.115.0. Servers exposed to the internet that have not received the update are at greatest risk now that a working exploit is public.

What to do

Plex advises all server owners to update to Plex Media Server 1.43.3 or newer without delay. Users with automatic updates enabled should still confirm the installed version, and Plex notes that NAS owners may need to install the package manually because their package managers may lag behind.

Administrators should also check servers that ran a vulnerable version for signs of compromise, such as unexpected CPU usage from mining activity, unknown processes like myawesomeproxy or unusual outbound connections. Limiting direct internet exposure of the Plex management interface reduces the attack surface further.