Patched in September, Plex Media Server flaws are now being exploited

On the morning of October 17, a researcher monitoring a fake Plex server, deliberately left running an old version, saw a real attack for the first time. The day before, another researcher had published a detailed write-up and the code for a chain of four vulnerabilities dubbed “Plex2Shell.” It took barely a day for it to be used.

On October 20, the U.S. cybersecurity agency CISA added these four flaws to its catalog of exploited vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex Media Server, software widely used by individuals and some small organizations, streams your movies and music to all your screens. You need to install version 1.43.3.10861 or a later one.

A chain that needs no password

Taken alone, each flaw looks minor. CVE-2026-96652, for example, lets a user with a valid token make the server send requests to other machines. Combined, according to SecurityWeek, the four flaws allow code to be executed on an exposed server, without credentials, with the privileges of the Plex service.

The researcher reported them to Plex on July 27. The vendor confirmed them on August 4 and paid a bounty. On September 1, it announced patches and asked owners of versions 1.43.2 and earlier to update without delay. The exploit code only appeared on October 16, six weeks after the patches.

What attackers install

On the honeypot, that is, the decoy server run by the researcher behind the BoredHackerBlog blog, the attacker first dropped a cryptocurrency miner built on XMRig. Later in the day, a proxy program, “myawesomeproxy,” arrived, which routes other people's traffic through the victim's connection.

The researcher points to another risk: many Plex servers run on home connections. An attacker could use them as a residential relay to reach corporate VPNs and email systems. Only this honeypot is documented so far: it is unknown how many real servers have been hit and who is behind these attacks.

What to do

The patch has been available since September. You just need to install it.

• Update Plex Media Server to 1.43.3.10861 or later, from the interface or from Plex's website.
• Do not expose the server directly to the internet if you don't need to.
• Check CPU activity: covert mining often shows up as a machine that heats up and runs its fans for no reason. The indicators published by the researcher reflect only their honeypot and are not exhaustive.
• In companies, ban this kind of personal server on workstations that access the internal network.

The same day, CISA also added to its catalog a flaw in SiteGuard Server Edition and another in Siemens Software Center. The next thing to watch: the actual number of compromised servers, still unknown.