Thousands of internet-exposed Plex Media Server setups are currently being hijacked by attackers deploying unauthorized cryptocurrency miners and residential proxy software through an unauthenticated remote code execution chain known as Plex2Shell. While developers issued a security patch weeks prior, tens of thousands of unpatched hosts remain vulnerable to automated exploitation.
How the Plex2Shell Exploit Chain Operates
Discovered by a security researcher who goes by ZM online, the exploit strings together four distinct vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The attack requires no prior authentication.
Attackers trick an exposed server into handing over the administrator token, allowing them to drop a malicious payload directly into the system’s Codecs directory. This persistence mechanism ensures the malicious binary executes automatically every time the media server transcodes a video file.
Unauthenticated RCE chain in Plex:$500 bountyWriteup: https://t.co/mpFPDLCPdePoC: https://t.co/cOli9jBrywPatch your servers! pic.twitter.com/GUufC4wnuf
As noted in public technical breakdowns, simply killing an active mining process fails to remediate the system because the persistent script reinfects the host upon the next transcoding cycle. Investigators observed threat actors deploying two primary payloads: an aggressive cryptocurrency miner and a utility named myawesomeproxy that transforms the victim’s home internet connection into a commercial proxy network.
The Timeline of Disclosure and Patch Availability
The vulnerability timeline began on July 27, when ZM reported the issue to Plex. Plex acknowledged the report and issued a $500 bug bounty on August 4, simultaneously pushing a secure build to the public. CVE identifiers for the bug chain were formally assigned on September 23.
If you run Plex at home, update it today. Exploit code for a four bug chain that gives unauthenticated code execution on Plex Media Server went public two days ago, and attackers were using it on a honeypot within a day to drop a Monero miner.Patched builds have been out since…
Public awareness escalated when an anonymous blogger operating boredhackerblog established a honeypot utilizing an older, vulnerable Plex build. On Saturday, October 17, that honeypot recorded active, in-the-wild exploitation using exploit code published on GitHub.
Kraken Chief Security Officer Nick Percoco highlighted the severity of the honeypot findings on social media, urging users running home media setups to update immediately. Despite public advisories and automated emails sent by Plex beginning September 1, telemetry data from Shadowserver indicates that nearly 49,000 hosts remain tagged as vulnerable-plex.
Server Owners Must Update Software to Stop Remote Compromise
Server owners must update their media software to version 1.43.3 or later to close the underlying attack vectors. Systems running versions prior to 1.43.3.10861 are susceptible to complete remote compromise.
Security guidance dictates that if an administrator suspects their machine suffered an intrusion, running a basic software update is insufficient. Plex recommends a complete clean reinstallation of the media server application alongside an exhaustive antivirus sweep and manual verification of active background processes to purge deeply embedded proxy tools and crypto-mining binaries.
More on Plex Media Server
🚨 UPDATE: CISA ADDS PLEX2SHELL CHAIN, SITEGUARD WAF AND SIEMENS SOFTWARE CENTER FLAWS TO KEVCISA added six exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct 20, 2026. When we covered Plex2Shell on Oct 18, the Plex CVEs were not in KEV. Now they… pic.twitter.com/1weQMKCw62
‼️CRITICAL SECURITY ALERT — Plex Media ServerA researcher has publicly disclosed Plex2Shell, an exploit chain targeting Plex Media Server that reportedly enables unauthenticated remote code execution (RCE).⚠️ Potential Impact:▪️ Remote server compromise▪️ Unauthorized…
