Plex vulnerability (Plex2Shell): the forgotten media server that can open your network
The office NAS has been running Plex for three years to serve training videos. Nobody looks after it: it just works. Since October 17, that’s exactly the kind of device attackers are going after.
The Plex vulnerability nicknamed Plex2Shell is actually a chain of four flaws in Plex Media Server. Together, they let a stranger on the internet, with no valid password, run code on an exposed Plex server. The fix has been out since September, but attack code was published on October 16 and successful attacks were seen the very next day. On October 19, Plex confirmed “active and widespread” exploitation.
4
chained flaws, none enough on its own
1 day
between the attack code going public and the first attacks
1.43.3
the version to install (build 10861 or later)
32400
the port you’d rather not open to the internet
The Plex vulnerability in four links
Taken one at a time, each flaw looks modest: the first one only has a medium severity score. It’s the chain that hands over full control.
Link 1
CVE-2026-96652
The way in
A player endpoint accepts any token: the server sends requests wherever the attacker says, including to itself.
Link 2
CVE-2026-96654
The internal functions
Functions meant only for the server itself become reachable through that detour.
Link 3
CVE-2026-96655
The owner’s token
The server hands over its owner’s admin token: the attacker now has full control of Plex.
Link 4
CVE-2026-96656
The file write
Through the transcoder settings, a malicious file is dropped in the Codecs folder, then executed.
The result: the attacker’s code runs with the Plex service’s privileges. On a NAS or PC that does other jobs too, those privileges can reach far beyond your movies.
45 days to patch, 1 day to attack
From discovery to attack (2026)
Each block’s length is proportional to the number of days until the next step.
The lesson goes beyond Plex: once attack code is public, the gap between “fix available” and “you’re a target” is measured in hours. Servers that update themselves were protected since September. The others weren’t.
Plex in a small business? More often than you’d think
🗄️
The office NAS
Many NAS devices offer Plex in one click. The same box often holds your shared folders and backups.
📺
The waiting-room TV
A clinic, gym or restaurant plays its videos with Plex, on an old PC that never gets updated.
🏠
An employee’s basement
The family media server shares an internet connection with the work laptop.
🎓
Training videos
An in-house “Netflix” for internal procedures, set up one Friday and forgotten ever since.
What attackers do with it: your connection, not your movies
The attacks seen so far install two things: a cryptocurrency miner, which wears out your hardware and runs up your power bill, and “proxy” software that routes other people’s traffic through your internet connection. The researcher who spotted the attacks put it this way: Plex is often hosted on a residential IP address, and attackers love those addresses for getting into corporate VPNs and email.
🕵️ Why it’s sneaky
Many alerts rely on where a sign-in comes from: an unusual country, a data centre address. A sign-in from a house in Laval triggers nothing. That’s why phishing-resistant multi-factor authentication and behaviour monitoring matter more than checking the IP address alone.
Signs of a compromised server
Plex published these indicators on October 19. They only cover what has been observed so far.
⚙️
Unknown processes
Started by Plex Media Server, especially myawesomeproxy, mylovelyminer or x12345.
📁
Unknown .so or .dll files
In the Plex Codecs folder.
🌡️
CPU running hot
While nothing is playing: the typical signature of a cryptocurrency miner.
🌐
Outbound connections
To proxystream.st, or unusual internet traffic at night.
What to do, in order
Six steps, from most urgent to most lasting
Update right away
Version 1.43.3.10861 or later. In Plex Web: Settings, General, the version is shown.
Look for the signs above
If the server was older and reachable from the internet, Plex says to treat it as possibly compromised.
When in doubt, rebuild
Reinstall cleanly instead of reusing the old data folder. At a minimum: empty the Codecs folder and check the transcoder options in Preferences.xml.
Kill the sessions
Sign out all devices from the Plex account and change its password.
Think beyond Plex
Anything the Plex service account could reach should be treated as exposed: mounted shares, passwords saved on the same machine.
Close what doesn’t need to be open
Don’t need remote access? Turn it off (Settings, Remote Access) and remove the port 32400 forward on the router.
And if your remote employees run Plex at home, a simple message this week (“Check your Plex version”) is a great preventive habit. For more on forgotten, exposed servers, read our article on AI servers exposed on the internet, and for the network side, our business network support page.
At NeoTech, our cybersecurity services start with an inventory of what’s exposed, then automated 24/7 monitoring with on-call technician response flags abnormal behaviour, such as a CPU racing at night.
Book your free cyber check
Not sure which devices on your network can be reached from the internet, or what’s running on the office NAS? The free cyber check starts right there: we find what’s exposed, what’s out of date and what shares a network with your workstations, then hand you a clear plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Plex: Important Security Update for Plex Media Server v1.43.2 and earlier (October 19, 2026 update)
- SecurityWeek: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure (October 19, 2026)
- Ars Technica: PSA: Patch your Plex media server before someone hacks it (October 19, 2026)
- CVE.org: CVE-2026-96652
Photo: Kaboompics.com, Pexels (Pexels licence).