Reported Plex2Shell Exploitation on an Unpatched Plex Server
A researcher recorded an attack using a publicly available exploit against an unpatched Plex Media Server on a honeypot. The fix is available in version 1.43.3.10861 and later.
Plex2Shell was reportedly used against unpatched Plex Media Server installations, according to a security researcher. The honeypot observation from October 17, reported by SecurityWeek on October 19, describes the use of a publicly available exploit followed by the deployment of the XMRig cryptocurrency miner and a proxy program.
The scope of the incident has not yet been confirmed. The information about active exploitation is based on a single researcher’s observation conveyed by SecurityWeek; Plex and the U.S. CISA agency have not publicly confirmed the scope of the campaign, the number of affected servers, or the attackers’ identity.
Plex2Shell Affects Older Server Versions
On September 1, Plex urged operators to update Plex Media Server to version 1.43.3 or later. CISA stated that Plex Media Server versions older than 1.43.3.10861 contain multiple vulnerabilities. In the worst case, they could lead to the theft of login credentials, followed by file writing or code execution.
The independently verified mitigation is updating to version 1.43.3.10861 or later. Operators should also check installations on NAS devices and in Docker containers.
Miner and Proxy Program Deployed After the Attack
According to SecurityWeek’s description, XMRig and a proxy program were deployed after the exploitation chain. Such deployment could lead to the abuse of server resources and network connectivity.
The risk primarily concerns publicly accessible and unpatched Plex Media Servers. However, the report does not confirm that other systems beyond the monitored honeypot were also attacked, nor does it state the extent of any potential damage.
Uncertainty Around CVE Designations
The technical details of the chain referred to as Plex2Shell are not consistent across all available materials. A candidate headline links the case to CVE-2026-96656, while CISA materials and the GitHub Advisory Database also link the chain to CVE-2026-96651. The exact composition of the vulnerabilities therefore cannot yet be stated with complete certainty.
Operators should not wait for all technical details to be clarified. The key step is to verify the Plex Media Server version and install the fixed release.
What to Watch Next
- confirmation of active exploitation by Plex, CISA, or additional independent researchers,
- possible inclusion of one of the vulnerabilities in the CISA Known Exploited Vulnerabilities catalog,
- additional indicators of compromise and information about other possible payloads besides XMRig and the proxy program,
- availability of fixed packages for specific NAS platforms and container deployments.
Sources
- Plex Forum — Important Security Update for Plex Media Server v1.43.2 and earlier – On September 1, Plex announced security updates and recommended that all server owners update to version 1.43.3 or later.
- CISA CSAF VA-26-266-01 – CISA documents multiple Plex Media Server vulnerabilities before version 1.43.3.10861, their potential impact, and the fix in 1.43.3.10861.
- SecurityWeek — Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure – Reports an exploitation observation on a honeypot on October 17 and the deployment of XMRig and a proxy program; the scope was not independently confirmed.
Verified and updated: October 19, 2026 15:25
