Full Breakdown
Plex Media Server Vulnerability Exploited in the Wild, Prompting Urgent Update Calls
By Drooid · · How we work
The Exploit Unfolds
A chain of four vulnerabilities—CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656—collectively dubbed Plex2Shell allows an unauthenticated attacker to obtain the server-owner’s admin token, write a malicious file to the Plex Codecs directory, and execute that file each time Plex transcodes video. The exploit works against any Plex Media Server version earlier than 1.43.3.10861. In the wild, attackers have dropped an XMRig-based cryptocurrency miner and a tool called myawesomeproxy, which routes external traffic through the compromised home network, effectively turning the server into a residential proxy.
Timeline of Disclosure and Response
- July 27 – Security researcher “ZM” reported the chain to Plex.
- August 4 – Plex acknowledged the report and issued a $500 bug bounty; the patched build was released the same day.
- September 1 – Plex posted a public advisory and emailed users of older versions, urging an upgrade.
- September 23 – The four CVEs were formally assigned.
- October 16 – Public proof-of-concept code for the full chain was published.
- October 17 – A researcher running a honeypot observed live exploitation using the published code, confirming the miner and proxy payloads in the wild.
Scope of Exposure
Scanning data show a large pool of still-vulnerable servers. Shadowserver identified nearly 49,000 exposed Plex instances, including about 25,100 in North America and 17,600 in Europe. Earlier assessments cited by Cord Cutters News counted more than 36,000 internet-facing instances still running vulnerable builds as of September. The discrepancy highlights uncertainty about the exact size of the attack surface.
Official Statements & Responses
The company also announced an access restriction for servers running versions 1.41.7.x to 1.42.0.x, preventing other users from connecting while the vulnerable version remains active. Plex noted that the bug bounty of $500 was paid for the critical exploit and that the CVEs had been requested and assigned.
Kraken’s Chief Security Officer Nick Percoco, referencing the honeypot incident, warned Plex users to apply the update immediately, emphasizing that the malicious payload resides in the Codecs folder and re-executes on each transcoding operation, meaning that simply killing the miner does not eradicate the threat.
Why It Matters
Beyond the immediate resource drain of crypto mining, the proxy component enables attackers to mask malicious traffic behind residential IP addresses, complicating attribution and facilitating further illicit activity. A prior incident involving LastPass demonstrated how a vulnerable third-party media package can be leveraged to implant keyloggers on a senior engineer’s home computer, underscoring the broader risk posed by unpatched Plex installations.
Conflicting Reports & Gaps
- Vulnerable server counts differ between Shadowserver (?49,000) and Cord Cutters News (?36,000).
- Exploitation scope remains unclear; the only confirmed in-the-wild case involves a controlled honeypot, with no publicly verified large-scale campaign against production systems.
Verbatim Quotes
- “We recommend all server owners and Desktop users update to the latest version as soon as possible,” — First Plex Exploit Plex
- “As a follow-up to the original report and in an abundance of caution due to a population of servers still on an affected Plex Media Server version (versions 1.41.7.x to 1.42.0.x), we have made adjustments for access to affected servers,” — First Plex Exploit Plex