2026-10-31
Plex2Shell: four Plex Media Server CVEs exploited in the wild (update to 1.43.3.10861 or later)
Plex2Shell is the name a security researcher gave to four flaws in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex says that chained together they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. All four are fixed in 1.43.3.10861, released to everyone on August 4, 2026. On October 19 (UTC) Plex wrote that the flaws are being actively and widely exploited after a public proof of concept appeared on October 16, and that compromised servers have been used to run cryptocurrency miners and proxy software. CISA added all four to its Known Exploited Vulnerabilities (KEV) catalog on October 20, with due dates of October 23 and November 3. Each CVE on its own scores only 4.3 to 7.2 (CVSS v3.1). Our conclusion: if you run Plex Media Server, check that it is on 1.43.3.10861 or later today, stop exposing port 32400 directly unless you need remote access, and if an older version was reachable from the internet, follow Plex's compromise checks and rebuild if in doubt.