Security incidents tagged Plex. Newest first.
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
Plex Media ServerSince Oct 16, 2026
🚨 PLEX2SHELL: PUBLIC EXPLOIT CHAIN TARGETS UNPATCHED PLEX MEDIA SERVERS A researcher published a full write-up and proof-of-concept on Oct 16, 2026 for "Plex2Shell", a chain of four Plex Media Server flaws that can end in remote code execution on servers older than t.co/yH1Ph3BY8g
plex2shell-wz coming soon to a plex server near you... > XOR/ChaCha20 encrypted C2 config > Libc-linked loader > High-entropy PRNG video tail > Randomized geometry & codec names > In-memory execution (memfd) #CyberSecurity #infosec t.co/yTf6NODtWZ
Plex2Shell is being exploited. A researcher's honeypot running old Plex Media Server got hit Oct 17, a day after the write-up went public. Payloads: XMRig and a proxy tool that routes traffic through your home IP. Unauth RCE, fixed in 1.43.3 in Sept. Update. #Plex #ThreatIntel t.co/6HiaJCcBFq
