chapter · Public write-up and exploitation
Plex2Shell: chained Plex Media Server RCE exploited for miners
› Plex Media Server
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Public write-up and exploitation
The bug goes public, honeypots see exploitation and CISA adds it to KEV.
CISA KEV warning; patch-by Oct 23 for federal agencies.
Honeypot exploitation (XMRig + proxy) observed.
Public write-up.
## summary
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
read the full incident →
