Story perspectives

Plex patches Plex2Shell after crypto-miner attacks detected

By Drooid · Oct 19, 2026, 6:19 PM UTC · How we work

Summary

Story summary

Plex released an August 2026 update that patched a remote code execution chain.
Researcher ZM disclosed the Plex2Shell chain linking CVE-2026-96652, -96654, -96655, -96656.
Plex paid a $500 bug bounty on August 4, 2026 and issued a September 1 advisory.
A honeypot observed exploitation on October 17, 2026 delivering a crypto miner that persisted in Plex’s Codecs folder during transcoding.
Shadowserver reported 49,000 exposed Plex servers remained vulnerable in October 2026, including 25,100 in North America.

1 of 1

Story summary

Plex released an August 2026 update that patched a remote code execution chain.
Researcher ZM disclosed the Plex2Shell chain linking CVE-2026-96652, -96654, -96655, -96656.
Plex paid a $500 bug bounty on August 4, 2026 and issued a September 1 advisory.
A honeypot observed exploitation on October 17, 2026 delivering a crypto miner that persisted in Plex’s Codecs folder during transcoding.
Shadowserver reported 49,000 exposed Plex servers remained vulnerable in October 2026, including 25,100 in North America.