criticallivepatched
chapter · Private report and quiet fix
Plex2Shell: chained Plex Media Server RCE exploited for miners
› Plex Media Server
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Private report and quiet fix
Reported privately to Plex and fixed in 1.43.3.10861 months before disclosure.
Plex ships 1.43.3.10861.
Zach Main reports issues to Plex.
## summary
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
read the full incident →
