{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:10:31.291Z",
  "tag": {
    "id": "plex",
    "label": "Plex",
    "isStack": false,
    "url": "https://pwn.watch/t/plex",
    "feed": "https://pwn.watch/t/plex/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "plex2shell-cve-2026-96652",
      "title": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652",
      "json": "https://pwn.watch/i/plex2shell-cve-2026-96652.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Plex Media Server",
      "tags": [
        "plex",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-96652",
        "CVE-2026-96654",
        "CVE-2026-96655",
        "CVE-2026-96656"
      ],
      "affectedVersions": [
        "Before 1.43.3.10861"
      ],
      "fixedVersions": [
        "1.43.3.10861+"
      ],
      "startedAt": "2026-10-16",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:20:00+02:00",
      "summary": "Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 PLEX2SHELL: PUBLIC EXPLOIT CHAIN TARGETS UNPATCHED PLEX MEDIA SERVERS\n\nA researcher published a full write-up and proof-of-concept on Oct 16, 2026 for \"Plex2Shell\", a chain of four Plex Media Server flaws that can end in remote code execution on servers older than https://t.co/yH1Ph3BY8g",
      "date": "2026-10-18T22:22:00.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2111945921852592206",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HU8jnq9a0AAr4W3.jpg"
        }
      ],
      "incident": "plex2shell-cve-2026-96652"
    },
    {
      "authorName": "Jλckλι",
      "handle": "J4ck3LSyN",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1392971712979881985/HIiu6LJ0_bigger.jpg",
      "text": "plex2shell-wz coming soon to a plex server near you... \n\n> XOR/ChaCha20 encrypted C2 config\n> Libc-linked loader\n> High-entropy PRNG video tail\n> Randomized geometry & codec names\n> In-memory execution (memfd) \n\n#CyberSecurity #infosec https://t.co/yTf6NODtWZ",
      "date": "2026-10-18T20:34:33.000Z",
      "url": "https://x.com/J4ck3LSyN/status/2111918880134414734",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HU8K0ZwacAAA-b5.png"
        }
      ],
      "incident": "plex2shell-cve-2026-96652"
    },
    {
      "authorName": "Phantom Radar🐦‍⬛",
      "handle": "phantmradar",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2104572729332482048/fG2NAZcl_bigger.jpg",
      "text": "Plex2Shell is being exploited. A researcher's honeypot running old Plex Media Server got hit Oct 17, a day after the write-up went public. Payloads: XMRig and a proxy tool that routes traffic through your home IP. Unauth RCE, fixed in 1.43.3 in Sept. Update. #Plex #ThreatIntel https://t.co/6HiaJCcBFq",
      "date": "2026-10-18T16:23:58.000Z",
      "url": "https://x.com/phantmradar/status/2111855821122650341",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HU7RoeKW8AApv78.png"
        }
      ],
      "incident": "plex2shell-cve-2026-96652"
    }
  ],
  "changes": [
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "CISA KEV warning; patch-by Oct 23 for federal agencies.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    },
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655).",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    },
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-17",
      "title": "Honeypot exploitation (XMRig + proxy) observed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    },
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-16",
      "title": "Public write-up.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    },
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-04",
      "title": "Plex ships 1.43.3.10861.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    },
    {
      "incident": "plex2shell-cve-2026-96652",
      "incidentTitle": "Plex2Shell: chained Plex Media Server RCE exploited for miners",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-07-27",
      "title": "Zach Main reports issues to Plex.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/plex2shell-cve-2026-96652"
    }
  ]
}