Key points
- Plex released updates on September 1 to fix four chained vulnerabilities allowing remote code execution.
- Researchers recorded live exploitation of a honeypot on October 17, 2026, installing mining and proxy malware.
- The attack uses Plex2Shell to bypass login requirements and execute code on Linux and Windows servers.
Plex Media Server versions before 1.43.3.10828 and Plex Desktop versions before 1.115.0 are affected by four security flaws. The vendor released patches on September 1, 2026, to address these issues. Users running older versions should install the updates immediately to prevent unauthorized access and malware installation.
In plain English
The vulnerabilities allow attackers to run commands on your server without logging in. They do this by chaining four separate flaws together. First, they trick the server into sending requests to internal services. Then, they gain access to authorized functions and write files to specific locations. Finally, they load an unsigned codec to execute malicious code.
The background
A public exploit called Plex2Shell was released, detailing how to chain these vulnerabilities. According to Cyber Security News, researchers observed active exploitation on October 17, 2026. The attackers targeted a Linux-based Plex server running in Docker. They installed XMRig cryptocurrency mining software and a proxy tool named myawesomeproxy.
What changes now
The Plex2Shell repository identifies version 1.43.3.10861 as the fixed release. Although the exploit supports both Linux and Windows, the reported attacks targeted Linux. The researcher noted that outbound traffic restrictions initially blocked some payload downloads. Once enabled, downloads from specific IP addresses were observed.
Who needs to act first
Teams should prioritize updating servers exposed to the internet or untrusted networks. Check whether your deployment uses Docker or NAS devices, as these may require manual update steps. Verify that backup procedures are current before applying patches to avoid service disruption. Monitor network logs for unusual outbound connections or unknown processes after updating.
What to do and how to stay safe: Plex
- Verify your current Plex Media Server and Desktop versions against the fixed release numbers.
- Install the latest security updates provided by the vendor on all affected systems.
- Review firewall rules to restrict unnecessary inbound and outbound traffic from media servers.
- Monitor system logs for unexpected processes or connections to known malicious domains.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific vulnerabilities are being exploited?
The attack chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to achieve remote code execution.
Is there a confirmed fix available?
Yes, Plex released security updates on September 1, 2026, including version 1.43.3.10861 for Media Server.
What malware are attackers installing?
Researchers observed the installation of XMRig cryptocurrency miners and a proxy tool called myawesomeproxy.
