Attackers have begun exploiting a chain of vulnerabilities dubbed “Plex2Shell” to compromise unpatched Plex Media Servers, enabling full remote takeover without authentication. The attack involves installing crypto miners and proxy software shortly after exploit code leaked publicly on October 16, 2026. Exploitations were confirmed as early as October 17.
What Is Plex2Shell?
The Plex2Shell exploit combines four critical flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). These bugs allow attackers to run arbitrary code with the same permissions as the Plex service, all without needing a password. The vulnerabilities were identified by researcher Zach Main, who responsibly disclosed them to Plex in July. A bug bounty payout followed in early August.
How the Exploit Works
Plex servers, often exposed to the internet via port 32400 for remote streaming, become prime targets under this attack model. The first exploitable flaw is a server-side request forgery issue in the /player/timeline endpoint: Plex only checks that a token is present, not whether it’s valid. An attacker can insert a full URL in the protocol field to trigger a request to the server itself.
This forged request is treated as internal by Plex, granting access to a plugin interface that normally doesn’t require authentication for local requests. Once inside, an attacker can call unsafe plugin functions. Using a TVDB plugin function and a manipulated address beginning with 127.0.0.1 that ultimately points to attacker-controlled infrastructure, the attacker tricks Plex into including an admin token in a request, giving them full control.
With admin access, the attacker modifies transcoding settings so Plex writes a malicious, hidden file into its codec folder. The payload is disguised inside a video file, triggering execution during regular video transcoding. Proof-of-concept code and detailed write-ups are already public.
Real-World Impact
The first confirmed compromises dropped a Monero miner based on XMRig and a Linux proxy tool dubbed “myawesomeproxy.” The miner was linked to the AISURU botnet, with payloads fetched from the IP 217.60.194[.]116. These incidents demonstrate that home setups and network-attached storage (NAS) devices are at risk.
Authorities and vendors have responded: Plex released a patched version, 1.43.3.10861, which mitigates the flaws. Meanwhile, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added all four CVEs to its Known Exploited Vulnerabilities list effective October 20. Some QNAP NAS appliances have been breached, according to recent reports.
What You Should Do Now
- Update Plex Media Server immediately to version 1.43.3.10861 or newer. Always verify the server’s reported version.
- If your server was exposed before patching, assume it’s compromised: look for strange child processes, unknown downloads, or high CPU usage.
- Turn off port forwarding for 32400 if you don’t need remote access. If remote access is essential, route traffic over VPN.
- Specifically for NAS users: perform a clean reinstall, reset all credentials, and scan for signs of infection.
This isn’t just another vulnerability—it’s a vivid reminder of how streaming platforms, often trusted and widely open to the internet, can become a gateway for cryptojacking and botnet activity. Plex2Shell illustrates how chaining relatively minor flaws can yield full server takeover. Moving forward, streaming service providers need to assume that edge-exposed instances are high-value targets. Vigilance, prompt patching, and reducing exposed attack surfaces must become standard practice. Watch for any unexpected server behavior, keep software up to date, and treat exposed servers as potentially compromised until proven clean.
