Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) has a public PoC and one honeypot hit

What happened

On 16 October 2026 a researcher published Plex2Shell, a write-up of four Plex Media Server bugs chained into remote code execution. The write-up says the chain needs no valid login. A public repository with the tooling went up too.

On 17 October 2026 a different researcher said the published code hit their honeypot. It ran an older Plex version. The attacker dropped a cryptominer. That is one honeypot. It is not a confirmed mass campaign.

Plex had already told users to update. Its forum notice and emails of 1 September 2026 covered versions 1.43.2 and earlier. The CVEs were published on 23 September 2026.

What is confirmed

• The CVEs. CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. NVD says Plex Media Server before 1.43.3.10861 is affected.
• NVD scores (CVSS 3.1). CVE-2026-96652 4.3, CVE-2026-96654 6.5, CVE-2026-96655 4.3, CVE-2026-96656 7.2. NVD also lists CVSS 4.0 scores of 5.3, 6.9, 5.3 and 8.6. No single NVD score exists for the chain.
• The chain, at a high level. Per the write-up: a server-side request forgery makes the server call itself. That reaches internal plugin functions. That leaks the owner's admin token. The token then lets an attacker write a library into the Codecs directory. The library runs when the transcoder starts, as the Plex service user.
• The repository. It is code-zm/plex2shell on GitHub. The researcher's blog links to it and its README links back to the blog. ThreatWire could not independently confirm that both belong to the same person. The README says it is an unauthenticated RCE chain, lists all four CVEs with one primitive each, and says it is for authorized testing. The README also claims a CVSS 3.1 score of 10.0 for the chain. That is the author's claim, not an NVD score. ThreatWire has not run it.
• Honeypot exploitation. The researcher's post (mirrored on unsafe.sh) says the honeypot saw exploitation with the repository's code on 17 October. It names three source IPs and a payload host. It says a miner was downloaded. Cord Cutters News reports the payload as an XMRig miner plus a proxy called myawesomeproxy.
• Fix. Plex Media Server 1.43.3.10861 or newer.
• KEV. The CVEs are not in the CISA KEV catalog as of 19 October 2026.

What is not known

• Whether any attack beyond that one honeypot has hit real servers. No mass campaign is confirmed.
• How many servers are exposed now. Cord Cutters says more than 36,000 internet-facing servers were unpatched in September. ThreatWire has not verified this.
• Why GitHub shows the repository as created on 18 October 2026, after reports of the code in use on 16 and 17 October. ThreatWire could not explain the gap.
• The affected range is not fully consistent. The README says "before 1.43.3.10828". NVD descriptions and Plex say before 1.43.3.10861. NVD's configuration data for CVE-2026-96656 lists 1.43.0.10861 as the end version. Use 1.43.3.10861.
• Related fix: NVD also lists CVE-2026-96651, a path traversal in /system/agents/media/get, fixed in the same release. It is not in the researcher's chain or the repository, so ThreatWire gives it no entry.

Who should act

• Anyone running Plex Media Server before 1.43.3.10861, especially on Linux or in Docker.
• Anyone who exposes port 32400 to the internet.
• NAS owners. Plex says NAS package managers may lag, and the update can be installed by hand.

What to do now

1. Update Plex Media Server to 1.43.3.10861 or newer.
2. Do not expose Plex to the internet if you do not need remote access. Turn off Remote Access and port forwarding of 32400 if unused.
3. Check for signs of compromise. Cord Cutters and the researcher list these:
   • child processes of the Plex Media Server binary you do not expect
   • processes named myawesomeproxy, mylovelyminer or x12345
   • command lines that mention rig IDs, donate levels or the domain proxystream.st
   • unknown shared library files in the Plex Codecs directory
   • unexpected outbound connections from the Plex host
4. If you suspect compromise, treat the host as untrusted. Rebuild from a clean base if you can confirm a hit.
5. Rotate the Plex token. Sign out all devices on plex.tv, change your password and reset the server's claim. The write-up says the owner token is the prize.
6. Review logs. Look at Plex and reverse proxy logs for odd requests to the player and transcoder endpoints from the days since 16 October.

Sources: Plex forum, NVD, CISA CSAF record, the zmain write-up, the researcher's honeypot post, Cord Cutters News and the Plex2Shell repository.