{"slug":"plex2shell","title":"Plex2Shell (Plex Media Server, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)","shortName":"Plex2Shell","seoTitle":"Plex2Shell (CVE-2026-96652): KEV, versions & detection","summary":"Four flaws in Plex Media Server before 1.43.3.10861. Plex (19 Oct 2026, 20:17 UTC) says they chain to unauthenticated code execution as the Plex process. CISA KEV listed all four on 20 Oct 2026 and says they can be chained. NVD publishes per-CVE descriptions only. Fixed build is 1.43.3.10861. Researcher chain CVSS 9.8; official per-CVE CISA CNA scores are 4.3, 6.5, 4.3, and 7.2.","isExample":false,"draft":false,"family":"plex2shell","kind":"single-product","aliases":["CVE-2026-96652","CVE-2026-96654","CVE-2026-96655","CVE-2026-96656","Plex Media Server","Plex2Shell"],"publishedAt":"2026-11-01","updatedAt":"2026-11-01","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-96652","cvss":{"cve":"CVE-2026-96656","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96656","sourceDate":"2026-10-21","checkedDate":"2026-11-01","dateLabel":"NVD lastModified","sourceLabel":"NVD record (CISA CNA CVSS 3.1 7.2, highest official per-CVE score; no NVD-produced Primary metric)","nvdPublishedDate":"2026-09-23"},"epss":{"cve":"CVE-2026-96652","score":0.01821,"percentile":0.78758,"date":"2026-10-31","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-96652","checkedDate":"2026-11-01"},"kev":{"cve":"CVE-2026-96652","listed":true,"dateAdded":"2026-10-20","dueDate":"2026-11-03","catalogVersion":"2026.10.30","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-01"},"addedDate":"2026-11-01"},"priority":{"label":"act-now"},"managementSummary":{"what":"Four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Plex (19 Oct 2026) says they chain to unauthenticated code execution as the Plex process. CISA KEV listed all four on 20 Oct 2026 and says they can be chained. NVD publishes per-CVE descriptions only. Official per-CVE CISA CNA scores peak at 7.2. Researcher chain score is 9.8.","action":"Upgrade every Plex Media Server older than 1.43.3.10861. If the host was reachable from an untrusted network while on an older build, treat it as potentially compromised, hunt the sourced process and file indicators, then rebuild and rotate credentials the service account could reach."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed (all four CVEs)","observer":"CISA","date":"2026-10-20","method":"CISA KEV catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries), checked 1 Nov 2026. dateAdded 2026-10-20 for CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. dueDate 2026-10-23 for 96654 and 96656; 2026-11-03 for 96652 and 96655. knownRansomwareCampaignUse Unknown. forensicTriage Yes on CVE-2026-96656 only.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"vendor-stated","value":"Actively and widely exploited","observer":"Plex","date":"2026-10-19","method":"PlexInfo update posted 19 Oct 2026, 20:17 UTC. Discourse topic JSON shows that post updated 20 Oct 2026, 14:34 UTC (version 4). Quote: These vulnerabilities are being actively and widely exploited. Compromised servers have been used to run cryptocurrency miners and proxy software.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"},{"metric":"third-party-stated","value":"Honeypot exploitation (cryptominer, later proxyware)","observer":"BoredHackerBlog","date":"2026-10-17","method":"Post dated 17 Oct 2026. First in-the-wild hit that morning on a vulnerable honeypot. Later the same day: XMRig and myawesomeproxy. One honeypot. Not a victim count.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"},{"metric":"exposed","value":323583,"observer":"Censys","date":"2026-10-20","method":"Censys 20 Oct 2026 advisory: Found 323,583 hosts matching the Plex Media Server product fingerprint. Not a vulnerable count. Censys also wrote that about 30 percent run a vulnerable build, and that the fixed build appeared in their data on 4 Aug 2026.","sourceUrl":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/"},{"metric":"possibly-vulnerable","value":"about 30 percent","observer":"Censys","date":"2026-10-20","method":"Censys 20 Oct 2026 advisory: About 30 percent run a vulnerable build. Share of hosts with a readable build, not a confirmed-vulnerable or compromise count. The 323,583 figure is the product fingerprint.","sourceUrl":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/"}],"seenInTheWildLinks":[{"title":"CISA Known Exploited Vulnerabilities catalog (CVE-2026-96652 listed 20 Oct 2026)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652","observer":"CISA","metric":"exploitation-confirmed"},{"title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","observer":"Plex","metric":"vendor-stated"},{"title":"Plex vulnerabilities being exploited in the wild to drop a cryptominer","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","observer":"BoredHackerBlog","metric":"third-party-stated"},{"title":"October 20 Advisory: Plex Media Server Remote Code Execution Chain","url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","observer":"Censys","metric":"possibly-vulnerable"}],"whatChanged":{"date":"2026-11-01","items":[{"text":"CISA listed all four Plex2Shell CVEs in the Known Exploited Vulnerabilities catalog on 20 Oct 2026 (catalog 2026.10.30 when checked 1 Nov 2026). Plex (19 Oct 2026, 20:17 UTC; Discourse post updated 20 Oct 2026, 14:34 UTC) said they are being actively and widely exploited.","headline":"CISA listed all four Plex2Shell CVEs in KEV on 20 Oct after Plex confirmed ITW","section":"exploitation","date":"2026-10-20","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"},{"text":"New catalog page for Plex2Shell on Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656).","headline":"New catalog page for Plex2Shell on Plex Media Server","section":"overview","date":"2026-11-01","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-01","kind":"page"}]},"whatTheBugIs":"Plex2Shell is a four-CVE chain in Plex Media Server before 1.43.3.10861. Plex (19 Oct 2026, 20:17 UTC) says that chained together, these issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. This page uses CISA and NVD wording for each CVE. Plex's own one-line summaries differ on CVE-2026-96654 and CVE-2026-96655; those vendor lines are kept dated below and are not used as the descriptions.\n\nCVE-2026-96652 (CWE-918). NVD (published 23 Sep 2026 17:17 UTC, lastModified 21 Oct 2026 13:09 UTC, status Analyzed, checked 1 Nov 2026): Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. CISA KEV name: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. CISA CNA CVSS 3.1 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Plex summary: Unauthenticated server-side request forgery in the player timeline endpoint.\n\nCVE-2026-96654 (CWE-84). NVD: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. CISA KEV name: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. CISA CNA CVSS 3.1 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Plex summary differs: Access to internal agent functions over the loopback interface.\n\nCVE-2026-96655 (CWE-918). NVD: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. CISA KEV name: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. CISA CNA CVSS 3.1 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Plex summary differs: Disclosure of the server owner's admin token.\n\nCVE-2026-96656 (CWE-73). NVD: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. CISA KEV name: Plex Media Server External Control of File Name or Path Vulnerability. CISA CNA CVSS 3.1 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). This is the highest official per-CVE score stored on this page. Plex summary: Arbitrary file write to the Codecs directory through transcoder preferences. CISA KEV forensicTriage is Yes for this CVE only.\n\nNVD records (checked 1 Nov 2026) republish those CISA CNA metrics as Secondary. No NVD-produced Primary CVSS 3.1 metric was present. Zach Main (16 Oct 2026) scores the full chain CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). That chain score is researcher-assigned, not an NVD metric.\n\nAffected: Plex Media Server before 1.43.3.10861, including the earlier 1.43.3.10828 build (Plex Releaser 14 Jul 2026; Censys 20 Oct 2026). Fixed: 1.43.3.10861 and later. Plex Releaser posted that 1.43.3.10861 was available to everyone on 4 Aug 2026, 16:09 UTC. A Plex Pass beta post is dated 3 Aug 2026. The 1 Sep 2026 security notice says Plex recently released 1.43.3. BleepingComputer (21 Oct 2026) and Censys (20 Oct 2026) also date the fixed-build release to 4 Aug 2026. Preconditions named in the sources: a reachable server (Zach Main and ctxsec: typically TCP 32400) and, for the first CVE, any X-Plex-Token value (NVD).\n\nExploitation status: confirmed. Plex (19 Oct 2026, 20:17 UTC; Discourse post updated 20 Oct 2026, 14:34 UTC) says the issues are being actively and widely exploited, with miners and proxy software on compromised servers. BoredHackerBlog recorded honeypot exploitation on 17 Oct 2026. CISA added all four CVEs to KEV on 20 Oct 2026 (catalog 2026.10.30 when checked 1 Nov 2026).\n\nCredit: Zach Main discovered the chain and published the write-up on 16 Oct 2026 (reported to Plex 27 Jul 2026 per that write-up and BleepingComputer). CISA CSAF VA-26-266-01 (23 Sep 2026) also names Zach Main. BoredHackerBlog published the 17 Oct 2026 honeypot report and lab pcaps. ctxsec published a 18 Oct 2026 hunt note (updated 20 Oct 2026).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Reachable media server","detail":"Network access to an affected Plex Media Server. Sources typically name TCP 32400. NVD: the first step accepts any X-Plex-Token value."},{"id":"unsafe","label":"Unauthenticated request-forgery","detail":"CVE-2026-96652 (CISA/NVD): server-side request forgery via the player timeline endpoint. Conceptual impact class only."},{"id":"app","label":"Internal plugin functions reached","detail":"CVE-2026-96654 (CISA/NVD): encoded URI values in searchOne can call other plugins' functions. Plex's shorter line names loopback agent access."},{"id":"exec","label":"Authenticated transcoder request-forgery","detail":"CVE-2026-96655 (CISA/NVD): an authenticated user can request arbitrary addresses via the transcoder path. Admin or owner context comes from the earlier steps, not from this CVE alone. Plex's shorter line names disclosure of the server owner's admin token."},{"id":"shell","label":"Code as the Plex process","detail":"CVE-2026-96656 (CISA/NVD): an admin-level file write that may run on load. Plex: code with the privileges of the Plex Media Server process."}]},"exploitation":{"kev":{"listed":true,"date":"2026-10-20","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries), checked 1 Nov 2026. All four CVEs dateAdded 2026-10-20. CVE-2026-96654 and CVE-2026-96656 dueDate 2026-10-23. CVE-2026-96652 and CVE-2026-96655 dueDate 2026-11-03. knownRansomwareCampaignUse Unknown. forensicTriage Yes on CVE-2026-96656 only."},"firstSeen":{"date":"2026-10-17","source":"BoredHackerBlog honeypot report","note":"BoredHackerBlog (17 Oct 2026) recorded the first public in-the-wild hit that morning on a vulnerable honeypot, after Zach Main's 16 Oct 2026 write-up. Plex (19 Oct 2026, 20:17 UTC; Discourse post updated 20 Oct 2026, 14:34 UTC) later said the issues were being actively and widely exploited. CISA listed all four CVEs on 20 Oct 2026. First calendar day of successful compromise outside that honeypot: not named."},"vendorStatements":[{"vendor":"Plex","date":"2026-10-19","statement":"Chained together, these issues let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. Plex Media Server 1.43.3.10861 and later are not affected. These vulnerabilities are being actively and widely exploited. A public proof of concept was released on October 16. Since then, we have seen widespread attacks against internet-facing servers that have not been updated. Compromised servers have been used to run cryptocurrency miners and proxy software. If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","retracted":false},{"vendor":"Plex","date":"2026-09-01","statement":"We recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible. CVEs have been requested...","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","retracted":false},{"vendor":"CISA","date":"2026-10-20","statement":"CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.","url":"https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog","retracted":false}]},"timeline":[{"date":"2026-07-27","event":"Zach Main says he reported the issues to Plex security. BleepingComputer (21 Oct 2026) repeats 27 Jul 2026 as the report day.","source":{"title":"Plex2Shell","url":"https://zmain.info/blog/plex2shell","publisher":"Zach Main"},"kind":"disclosure","key":true,"addedDate":"2026-11-01"},{"date":"2026-08-03T13:59:00Z","event":"Plex Releaser: Plex Media Server 1.43.3.10861 is now available to Plex Pass users in the Beta update channel. Notes include security changes to CompanionProxy and to TranscoderH264Options.","source":{"title":"Plex Media Server (post 712)","url":"https://forums.plex.tv/t/plex-media-server/30447/712","publisher":"Plex"},"kind":"patch","addedDate":"2026-11-01"},{"date":"2026-08-04T16:09:00Z","event":"Plex Releaser: Plex Media Server 1.43.3.10861 is now available to everyone. BleepingComputer and Censys also date this fixed-build release to 4 Aug 2026.","source":{"title":"Plex Media Server (post 713)","url":"https://forums.plex.tv/t/plex-media-server/30447/713","publisher":"Plex"},"kind":"patch","key":true,"addedDate":"2026-11-01"},{"date":"2026-09-01T18:30:00Z","event":"Plex published the security notice: we recently released Plex Media Server 1.43.3. This is the later public security announcement, not the Releaser post that dated 1.43.3.10861 to 4 Aug 2026.","source":{"title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","publisher":"Plex"},"kind":"advisory","key":true,"addedDate":"2026-11-01"},{"date":"2026-09-23T15:39:29Z","event":"CISA published CSAF VA-26-266-01 for Plex Media Server before 1.43.3.10861. Credit: Zach Main. The advisory also names related CVE-2026-96651, which is not in this page's four-CVE chain.","source":{"title":"VA-26-266-01","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","publisher":"CISA"},"kind":"advisory","addedDate":"2026-11-01"},{"date":"2026-09-23T17:17:23Z","event":"NVD published CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Status when opened on 1 Nov 2026: Analyzed. Metrics are CISA CNA Secondary.","source":{"title":"NVD - CVE-2026-96652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-11-01"},{"date":"2026-10-16","event":"Zach Main published the Plex2Shell write-up and linked github.com/code-zm/plex2shell. Plex later said a public proof of concept was released on 16 Oct 2026. BleepingComputer dates the PoC three days after the write-up (19 Oct). Both dates are sourced; they are not resolved here.","source":{"title":"Plex2Shell","url":"https://zmain.info/blog/plex2shell","publisher":"Zach Main"},"kind":"poc","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-16T20:31:21Z","event":"GitHub repo gmh5225/plex2shell shows pushed_at 16 Oct 2026 20:31 UTC (created 17 Oct 2026 01:44 UTC). README claims CVSS 3.1 10.0. That score is unverified against NVD. Index link only.","source":{"title":"gmh5225/plex2shell","url":"https://github.com/gmh5225/plex2shell","publisher":"GitHub"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-10-17","event":"BoredHackerBlog: as of this morning (17 Oct), in-the-wild exploitation on a vulnerable honeypot, later dropping a cryptominer and myawesomeproxy. Lab pcaps published the same day.","source":{"title":"Plex vulnerabilities being exploited in the wild to drop a cryptominer","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","publisher":"BoredHackerBlog"},"kind":"exploited","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-18T05:00:14Z","event":"GitHub repo code-zm/plex2shell created (Zach Main write-up links here). README scores the chain CVSS 3.1 9.8. Detection folder is linked from Detection, not from /pocs.","source":{"title":"code-zm/plex2shell","url":"https://github.com/code-zm/plex2shell","publisher":"GitHub"},"kind":"poc","addedDate":"2026-11-01"},{"date":"2026-10-19T20:17:00Z","event":"PlexInfo update: CVE table, actively and widely exploited, public PoC on 16 Oct, miners and proxy software, rebuild guidance, and process names myawesomeproxy, mylovelyminer, and x12345. Discourse topic JSON shows that post updated 20 Oct 2026, 14:34 UTC (version 4).","source":{"title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","publisher":"Plex"},"kind":"exploited","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-20","event":"CISA added all four CVEs to KEV and published the six-vulnerability alert. dueDate 23 Oct 2026 for CVE-2026-96654 and CVE-2026-96656; 3 Nov 2026 for CVE-2026-96652 and CVE-2026-96655.","source":{"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-01"},{"date":"2026-10-20","event":"Censys advisory: 323,583 hosts matching the Plex Media Server fingerprint; about 30 percent on a vulnerable build; fixed build first seen in their data on 4 Aug 2026.","source":{"title":"October 20 Advisory: Plex Media Server Remote Code Execution Chain","url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","publisher":"Censys"},"kind":"advisory","addedDate":"2026-11-01"},{"date":"2026-10-21","event":"BleepingComputer: CISA warning, Zach Main credit, report date 27 Jul 2026, and the statement that 1.43.3.10861 was released on 4 Aug 2026. Also dates the PoC three days after the 16 Oct write-up.","source":{"title":"CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","publisher":"BleepingComputer"},"kind":"advisory","addedDate":"2026-11-01"},{"date":"2026-10-21T13:09:44Z","event":"NVD last modified CVE-2026-96652 (13:09 UTC). Sibling records for 96654, 96655, and 96656 were lastModified the same hour. Status Analyzed.","source":{"title":"NVD - CVE-2026-96652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-11-01"}],"openNotes":[{"title":"Fix-release date: 4 Aug 2026 versus the 1 Sep 2026 notice","detail":"Plex Releaser (4 Aug 2026, 16:09 UTC) says 1.43.3.10861 is now available to everyone. BleepingComputer (21 Oct 2026) and Censys (20 Oct 2026) use that 4 Aug date. The 1 Sep 2026 Plex security notice says we recently released Plex Media Server 1.43.3 and does not name 4 Aug. Those are different posts. This page treats 4 Aug 2026 as the public everyone-channel release day from the Releaser post, and 1 Sep 2026 as the later security announcement.","sources":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/713","date":"2026-08-04","publisher":"Plex"},{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-09-01","publisher":"Plex"},{"url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","date":"2026-10-21","publisher":"BleepingComputer"}]},{"title":"Vendor summaries differ from CISA/NVD on CVE-2026-96654 and CVE-2026-96655","detail":"Plex (19 Oct 2026): 96654 is access to internal agent functions over the loopback interface; 96655 is disclosure of the server owner's admin token. CISA/NVD: 96654 is improper neutralization of encoded URI schemes / searchOne plugin-function calls; 96655 is authenticated SSRF on /video/:/transcode/universal. This page uses the CISA/NVD wording and keeps the Plex lines dated.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654","date":"2026-10-21","publisher":"NVD"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96655","date":"2026-10-21","publisher":"NVD"}]},{"title":"Public PoC date: 16 Oct versus 19 Oct","detail":"Plex (19 Oct 2026) says a public proof of concept was released on 16 Oct 2026. Zach Main's write-up is dated 16 Oct 2026 and links to code-zm/plex2shell. SecurityWeek (19 Oct 2026) and Censys (20 Oct 2026) also date the write-up and exploit code to 16 Oct 2026. gmh5225/plex2shell commits authored by ZM (same author as code-zm) are dated 16 Oct 2026, with first commit 16:41 UTC. BleepingComputer (21 Oct 2026) says the write-up was 16 Oct and the PoC followed three days later. code-zm/plex2shell was created 18 Oct 2026 05:00 UTC. Both dates are shown. They are not resolved here.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/","date":"2026-10-19","publisher":"SecurityWeek"},{"url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","date":"2026-10-20","publisher":"Censys"},{"url":"https://github.com/gmh5225/plex2shell/commits","date":"2026-10-16","publisher":"GitHub"},{"url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","date":"2026-10-21","publisher":"BleepingComputer"},{"url":"https://github.com/code-zm/plex2shell","date":"2026-10-18","publisher":"GitHub"}]},{"title":"Related CVE-2026-96651 is not this chain","detail":"CISA CSAF VA-26-266-01 (23 Sep 2026) also names CVE-2026-96651 (path traversal via /system/agents/media/get) with the same fixed build 1.43.3.10861 and the same Zach Main credit. Plex's 19 Oct CVE table and CISA KEV for this incident name only the four chain CVEs. CVE-2026-96651 is not in KEV (catalog 2026.10.30, checked 1 Nov 2026). It is not a headline CVE on this page.","sources":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","date":"2026-09-23","publisher":"CISA"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-30","publisher":"CISA"}]},{"title":"No public Nuclei YAML at the canonical path","detail":"None found at the canonical path on 1 Nov 2026 (http/cves/2026/CVE-2026-96652.yaml and the sibling 96654, 96655, and 96656 files under projectdiscovery/nuclei-templates). Do not invent one. Hunt pointers stay under Detection.","sources":[{"url":"https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026","date":"2026-11-01","publisher":"projectdiscovery"}]}],"defenderActions":[{"title":"Inventory every media server and whether untrusted networks can reach it","detail":"Record product, build, and whether an untrusted network can complete a connection to the service (sources typically name TCP 32400). Include NAS packages and containers. A 1.43.3 banner is not enough: 1.43.3.10828 is still in the affected range.","priority":"now","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"}]},{"title":"Upgrade every host older than the fixed build","detail":"The fixed build is 1.43.3.10861. An upgrade does not clear a host that was reachable while vulnerable. Plex: assume compromise if the older build was reachable from the internet.","priority":"now","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"}]},{"title":"If the host was reachable while vulnerable, hunt then rebuild","detail":"Review process lists, the codec folder, transcoder preferences, and outbound DNS or HTTP for the sourced names. Preserve logs first. Plex asks for a clean install rather than reuse of the old data directory when compromise cannot be ruled out.","priority":"now","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"},{"label":"BoredHackerBlog honeypot report","href":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html"}]},{"title":"Restrict untrusted reachability if remote access is not required","detail":"Plex: if you do not need remote access, turn it off and avoid forwarding the media port directly. That is a reachability control, not a software fix.","priority":"now","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"}]}],"detection":[{"title":"Player-timeline requests where protocol holds a full URL","detail":"ctxsec (18 Oct 2026, updated 20 Oct) and BoredHackerBlog (17 Oct): hunt proxy, Zeek, or HTTP logs on TCP 32400 for /player/timeline/subscribe or /player/timeline/* where protocol= holds a full URL, especially a loopback URL under /system/agents/. A request is a lead, not proof. Do not send crafted requests.","logSource":"Reverse-proxy / Zeek / HTTP access logs for TCP 32400","kind":"generic","group":"web-proxy","url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20"},{"title":"DNS or HTTP to 127.0.0.1.*.sslip.io from the media-server host","detail":"ctxsec and BoredHackerBlog: owner-token theft used hostnames that start 127.0.0.1. under sslip.io. Hunt DNS and outbound HTTP from the Plex host. The hostname pattern is easy to change. A lookup is a lead, not proof.","logSource":"DNS resolver logs and outbound HTTP from the Plex host","kind":"generic","url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20"},{"title":"Transcoder options you did not set in Preferences.xml","detail":"Plex (19 Oct 2026): check Preferences.xml for transcoder options you did not set. This is host-file review, not a network signature.","logSource":"Plex Preferences.xml on the host","kind":"generic","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19"},{"title":"TranscoderH264Options containing dump-yuv","detail":"ctxsec (18 Oct 2026, updated 20 Oct) and Zach Main (16 Oct 2026): hunt Preferences.xml for TranscoderH264Options containing dump-yuv (ctxsec also names stats=). Plex does not name dump-yuv. Presence is a lead.","logSource":"Plex Preferences.xml on the host","kind":"generic","url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20"},{"title":"Unexpected .so or .dll files in the Plex Codecs folder","detail":"Plex: unfamiliar .so or .dll files in the Codecs folder. ctxsec: new files, odd size or padding, or a loaded file shown as (deleted) under /Codecs/ in /proc/<pid>/maps. Compare timestamps to surrounding codec files.","logSource":"Plex Codecs directory on the host filesystem","kind":"generic","group":"edr","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19"},{"title":"Plex Media Server or Plex Transcoder spawning unexpected children","detail":"Plex names child processes myawesomeproxy, mylovelyminer, or x12345, plus outbound connections to proxystream.st and high CPU while nothing is playing. ctxsec: parent image matching Plex Media Server or Plex Transcoder spawning a process outside the install directory. BoredHackerBlog also recovered XMRig and myawesomeproxy on one honeypot.","logSource":"EDR / process-creation logs, plus outbound DNS or HTTP from the Plex host","kind":"generic","group":"edr","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19"}],"detectionRules":[{"id":"v2s-sigma-plex2shell-timeline-protocol","title":"Plex2Shell player-timeline protocol URL hunt","language":"sigma","query":"title: Plex2Shell player-timeline protocol URL hunt\nid: 7c2e1a90-4d5b-4f18-9a31-6e8c0b72d4f1\nstatus: experimental\ndescription: Detects HTTP requests to Plex /player/timeline where a protocol parameter holds a full URL. Path hunt only. Not a payload detector.\nreferences:\n    - https://ctxsec.com/items/hunt-plex2shell-exploitation.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-96652\nauthor: vuln2shell\ndate: 2026-11-01\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-stem|contains: '/player/timeline'\n        cs-uri-query|re: '(?i)(^|[?&])protocol=https?(://|:%2f%2f|%3a%2f%2f|%253a%252f%252f)'\n    condition: selection\nfalsepositives:\n    - Normal Plex Companion traffic uses protocol=http without a URL and should not match\n    - Substrings such as xprotocol= should not match\nlevel: high","logSource":"Reverse-proxy / Zeek / HTTP access logs for TCP 32400","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from ctxsec and BoredHackerBlog path notes. Matches a full URL in a protocol= parameter at a ? or & boundary (or start of a query-string field), including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match. A request is not proof of compromise. Tune field names to your shipper.","tested":"untested"},{"id":"v2s-spl-plex2shell-timeline-protocol","title":"Plex2Shell player-timeline protocol URL hunt (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=zeek:http OR sourcetype=nginx:plus:access) \"/player/timeline\"\n| regex _raw=\"(?i)(^|[?&])protocol=https?(?::\\/\\/|:%2f%2f|%3a%2f%2f|%253a%252f%252f)\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / Zeek / HTTP access logs for TCP 32400","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Matches a full URL in a protocol= parameter at a ? or & boundary, including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match. Tune sourcetype.","tested":"untested"},{"id":"v2s-kql-plex2shell-timeline-protocol","title":"Plex2Shell player-timeline protocol URL hunt (KQL)","language":"kql","query":"union isfuzzy=true CommonSecurityLog, W3CIISLog, Syslog\n| where TimeGenerated > ago(14d)\n| where * has \"/player/timeline\" and * matches regex @\"(?i)(^|[?&])protocol=https?(://|:%2f%2f|%3a%2f%2f|%253a%252f%252f)\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, Type\n| order by count_ desc","logSource":"Reverse-proxy / Zeek / HTTP access logs shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Table and field names vary by parser. Matches a full URL in a protocol= parameter at a ? or & boundary, including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match.","tested":"untested"},{"id":"v2s-esql-plex2shell-timeline-protocol","title":"Plex2Shell player-timeline protocol URL hunt (ES|QL)","language":"esql","query":"FROM logs-*\n| EVAL q = TO_LOWER(CONCAT(COALESCE(url.query, \"\"), \" \", COALESCE(url.original, \"\")))\n| WHERE TO_LOWER(COALESCE(url.path, \"\")) LIKE \"*player/timeline*\" AND q RLIKE \"(.*[?&])?protocol=https?(://|:%2f%2f|%3a%2f%2f|%253a%252f%252f).*\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip","logSource":"Reverse-proxy / Zeek / HTTP access logs shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. TO_LOWER makes scheme and percent-hex case-insensitive. Matches a full URL in a protocol= parameter at a ? or & boundary (or start of url.query), including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match. Index and field names vary by ingest pipeline.","tested":"untested"},{"id":"v2s-suricata-plex2shell-timeline-protocol","title":"Plex2Shell player-timeline protocol URL hunt (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"VULN2SHELL Plex2Shell player-timeline protocol URL CVE-2026-96652\"; flow:established,to_server; http.uri; content:\"/player/timeline\"; nocase; pcre:\"/[?&]protocol=https?(?::\\/\\/|:%2f%2f|%3a%2f%2f|%253a%252f%252f)/i\"; classtype:web-application-attack; sid:1966521; rev:2;)","logSource":"IDS / IPS in front of Plex Media Server","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Local sid 1966521. Path hunt only. content nocase plus PCRE /i so scheme and percent-hex are case-insensitive. Matches a full URL in a protocol= parameter at a ? or & boundary, including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match. Not a payload detector.","tested":"untested"},{"id":"v2s-yara-plex2shell-plex-named-processes","title":"Plex-named Plex2Shell process strings","language":"yara","query":"rule v2s_plex2shell_plex_named_processes {\n  meta:\n    author = \"vuln2shell\"\n    date = \"2026-11-01\"\n    description = \"Plex-published process names from the 19 Oct 2026 notice\"\n    source = \"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319\"\n  strings:\n    $a = \"myawesomeproxy\" ascii wide\n    $b = \"mylovelyminer\" ascii wide\n    $c = \"proxystream.st\" ascii wide\n  condition:\n    any of them\n}","logSource":"Forensic image or file scan of the Plex host","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19","license":"CC0 1.0","origin":"vuln2shell","notes":"Strings from the Plex 19 Oct 2026 notice. x12345 is omitted: a six-character string over-matches. Actor tooling rotates. BoredHackerBlog recovered myawesomeproxy on one honeypot; that is not a complete list.","tested":"untested"}],"detectionLinks":[{"title":"Hunt: Plex2Shell exploitation of Plex Media Server","url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","author":"ctxsec","date":"2026-10-20","note":"Hunt note dated 18 Oct 2026, updated 20 Oct 2026. Path, DNS, prefs, and process pointers. This site does not republish exploit code."},{"title":"Plex Oct 19 process and file indicators","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","author":"Plex","date":"2026-10-19","note":"Vendor list: myawesomeproxy, mylovelyminer, x12345, unfamiliar Codecs files, proxystream.st, unexpected transcoder options."},{"title":"BoredHackerBlog honeypot report and plex2shell_pcap","url":"https://github.com/BoredHackerBlog/plex2shell_pcap","author":"BoredHackerBlog","date":"2026-10-17","note":"Lab and honeypot pcaps for signature work. Detection artefacts, not a /pocs listing."},{"title":"code-zm/plex2shell detection folder","url":"https://github.com/code-zm/plex2shell/tree/main/detection","author":"code-zm / Zach Main","date":"2026-10-18","note":"Researcher hunt script and YARA. Read them before use. Linked from Detection, not from /pocs."}],"retrohunt":{"summary":"If a Plex Media Server older than 1.43.3.10861 was reachable from 16 Oct 2026, hunt proxy or Zeek logs for /player/timeline requests where protocol holds a full URL, DNS to 127.0.0.1.*.sslip.io, transcoder options you did not set (ctxsec and Zach Main name dump-yuv), new files in Codecs, and the Plex-named processes.","lookback":{"from":"2026-10-16","basis":"public-disclosure","rationale":"Zach Main published details on 16 Oct 2026. Plex says a public PoC was released that day and attacks followed. BoredHackerBlog first recorded in-the-wild use on 17 Oct 2026. Hunt from the public disclosure day.","sources":[{"url":"https://zmain.info/blog/plex2shell","date":"2026-10-16","publisher":"Zach Main"},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","date":"2026-10-17","publisher":"BoredHackerBlog"},{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},"logSources":[{"name":"Reverse-proxy / Zeek / HTTP access logs for TCP 32400","why":"ctxsec and BoredHackerBlog: hunt /player/timeline requests where protocol= holds a full URL.","required":true},{"name":"DNS resolver logs and outbound HTTP from the Plex host","why":"ctxsec: 127.0.0.1.*.sslip.io callbacks. Plex: outbound connections to proxystream.st.","required":true},{"name":"Plex Preferences.xml and the Codecs directory","why":"Plex: unexpected transcoder options and unfamiliar .so or .dll files.","required":true},{"name":"EDR / process-creation logs","why":"Plex names myawesomeproxy, mylovelyminer, and x12345 as children of Plex Media Server.","required":false}],"steps":[{"title":"List /player/timeline requests where protocol holds a URL since 16 Oct 2026","detail":"Search proxy, Zeek, or HTTP logs on TCP 32400. A request is a lead, not proof. Do not send crafted requests.","sources":[{"url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20","publisher":"ctxsec"}]},{"title":"Review Preferences.xml and the Codecs folder","detail":"Plex: check for transcoder options you did not set, and delete or quarantine unfamiliar .so or .dll files after you preserve copies.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"title":"Hunt Plex-named child processes and proxystream.st","detail":"Plex: myawesomeproxy, mylovelyminer, x12345, outbound connections to proxystream.st, and high CPU while nothing is playing. BoredHackerBlog recovered myawesomeproxy and XMRig on one honeypot.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","date":"2026-10-17","publisher":"BoredHackerBlog"}]}],"queries":[{"id":"v2s-spl-plex2shell-retrohunt","title":"Plex2Shell timeline and sslip.io since 16 Oct 2026","language":"spl","query":"index=* (\"/player/timeline\" OR \"sslip.io\" OR \"proxystream.st\" OR \"myawesomeproxy\" OR \"mylovelyminer\") earliest=10/16/2026:00:00:00\n| regex _raw=\"(?i)sslip\\.io|proxystream\\.st|myawesomeproxy|mylovelyminer|(?:/player/timeline.*[?&]protocol=https?(?::\\/\\/|:%2f%2f|%3a%2f%2f|%253a%252f%252f))\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, sourcetype\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Reverse-proxy / Zeek / DNS / EDR","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback from the public disclosure day. Timeline hunt matches a full URL in a protocol= parameter at a ? or & boundary, including half-encoded (http:%2F%2F) and double-encoded (%253A%252F%252F) forms. Companion protocol=http and substrings such as xprotocol= should not match. x12345 is omitted from this query (six characters; same over-match as the YARA rule). Hunt it as a child of Plex Media Server if you need that vendor name. Tune sourcetype.","tested":"untested","timeRange":"From 16 Oct 2026 (public disclosure) through the last patch window"}],"artefacts":[{"kind":"web-log","value":"/player/timeline with protocol= holding a full URL","detail":"ctxsec and BoredHackerBlog path hunt. A request is not proof.","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20"},{"kind":"network","value":"127.0.0.1.*.sslip.io","detail":"ctxsec: owner-token theft hostname pattern from the public write-up and honeypot. Easy to change.","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20"},{"kind":"file","value":"TranscoderH264Options containing dump-yuv in Preferences.xml","detail":"ctxsec (20 Oct 2026) and Zach Main (16 Oct 2026). Presence is a lead. Plex asks to check Preferences.xml for transcoder options you did not set and does not name dump-yuv.","sourceUrl":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","sourceDate":"2026-10-20"},{"kind":"file","value":"Unexpected .so or .dll in the Plex Codecs folder","detail":"Plex: unfamiliar shared libraries in Codecs. Actor tooling rotates.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"kind":"process","value":"myawesomeproxy, mylovelyminer, or x12345 as a child of Plex Media Server","detail":"Plex-named indicators from the 19 Oct 2026 notice. BoredHackerBlog recovered myawesomeproxy on one honeypot.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"kind":"network","value":"Outbound connections to proxystream.st","detail":"Plex-named destination. BoredHackerBlog also saw traffic related to that name on the honeypot proxy sample.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"}],"iocs":[{"type":"ip","value":"45.194.92.222","context":"BoredHackerBlog honeypot exploitation source on 17 Oct 2026. One honeypot. Actor addresses rotate.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"ip","value":"91.92.40.202","context":"BoredHackerBlog honeypot exploitation source on 17 Oct 2026.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"ip","value":"176.65.139.228","context":"BoredHackerBlog honeypot exploitation source on 17 Oct 2026.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"ip","value":"217.60.194.116","context":"BoredHackerBlog: payload download host for files named docker and x.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"hash","value":"5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441","context":"SHA-256 for docker dropper from one BoredHackerBlog honeypot.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"hash","value":"68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7","context":"SHA-256 for x (UPX-packed miner) from one BoredHackerBlog honeypot.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"hash","value":"b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49","context":"SHA-256 for unpacked x from one BoredHackerBlog honeypot.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"hash","value":"2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db","context":"SHA-256 for xmrig from one BoredHackerBlog honeypot.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"hash","value":"e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9","context":"SHA-256 for myawesomeproxy from one BoredHackerBlog honeypot.","sourceUrl":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","sourceDate":"2026-10-17"},{"type":"filename","value":"myawesomeproxy","context":"Plex-named process and BoredHackerBlog honeypot sample.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"type":"domain","value":"proxystream.st","context":"Plex-named outbound destination. BoredHackerBlog also saw related traffic from the proxy sample.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"}],"iocNote":"BoredHackerBlog published the IPs and hashes from one honeypot on 17-18 Oct 2026 and warned that the actor can change ports, hostnames, and file names. Plex names process and domain indicators from its 19 Oct 2026 notice. These are starting points, not a complete list.","hitMeaning":[{"level":"attempt","detail":"A /player/timeline request where protocol holds a URL, with no matching prefs change, Codecs file, or Plex-named child process."},{"level":"likely-compromise","detail":"Those requests plus dump-yuv in Preferences.xml (ctxsec and Zach Main), a new .so or .dll in Codecs, or a Plex-named child process on a host that was reachable before 1.43.3.10861."},{"level":"compromise","detail":"Recovered miner or proxyware, or vendor-confirmed intrusion. Plex: if the older build was reachable from the internet, assume it may be compromised until reviewed.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Preserve logs and the Codecs folder, then rebuild","detail":"Plex: rebuild from a clean installation rather than reuse of the old data directory. At minimum, delete everything in the Codecs folder after you keep copies, and check Preferences.xml.","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"}]},{"title":"Rotate the Plex account and anything the service account could reach","detail":"Plex: sign out of all devices, change the Plex password, and treat mounted shares and credentials on the same machine or VM as potentially exposed.","links":[{"label":"Plex security notice","href":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319"}]}],"limits":["BoredHackerBlog IOCs are from one honeypot. Actor tooling rotates.","sslip.io hostnames and process names are easy to change.","A /player/timeline request is a lead, not proof of compromise.","First calendar day of successful compromise outside the honeypot: not named."],"sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","date":"2026-10-17","publisher":"BoredHackerBlog"},{"url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20","publisher":"ctxsec"}],"updatedAt":"2026-11-01"},"amIAffected":{"summary":"Plex names every Media Server older than 1.43.3.10861 as affected when it is reachable. The fix is 1.43.3.10861. Early 1.43.3.10828 is still affected. Check Settings, General for the build. NAS package managers may lag the Downloads page.","checks":[{"id":"v2s-aia-plex2shell-version-1","kind":"version","title":"Record the Plex Media Server build against 1.43.3.10861","detail":"Plex (19 Oct 2026): open Plex Web, go to Settings, General, and read the version shown. Affected: older than 1.43.3.10861. Fixed: 1.43.3.10861 or later. 1.43.3.10828 is still affected. Do not send crafted requests.","command":"Record the installed Plex Media Server version from Settings, General and compare it to 1.43.3.10861 (affected: older than 1.43.3.10861, including 1.43.3.10828; fixed: 1.43.3.10861 or later).","affectedMeans":"The installed version is older than 1.43.3.10861.","fixedMeans":"The installed version is 1.43.3.10861 or later.","notes":"This is inventory only. A 1.43.3 banner is not enough. NAS app stores may still ship an older package after the Downloads page has the fix.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"id":"v2s-aia-plex2shell-config-2","kind":"config","title":"Record whether untrusted networks can reach the media server","detail":"Plex: if the server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised. Zach Main and ctxsec typically name TCP 32400. Record Remote Access state and whether that port is forwarded. Do not probe the bug.","command":"On each Plex Media Server, record whether Remote Access is on and whether an untrusted network can complete a TCP connection to the media port (sources typically name 32400).","affectedMeans":"An untrusted network can reach a host older than 1.43.3.10861.","fixedMeans":"The host is on 1.43.3.10861 or later, or untrusted networks cannot reach the media port.","notes":"Reachability is a precondition, not proof of compromise.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"id":"v2s-aia-plex2shell-exposure-3","kind":"exposure","title":"Scoped product-fingerprint search for your own ranges","detail":"Censys (20 Oct 2026) used host.services.software:(vendor=\"plex\" and product=\"media_server\") and counted 323,583 hosts. That is a product fingerprint, not a vulnerable count. Scope any search to your estate.","command":"censys search 'host.services.software:(vendor=\"plex\" and product=\"media_server\") and org:\"<your org>\"'","affectedMeans":"A host in your range matches the Plex Media Server fingerprint and is older than 1.43.3.10861.","fixedMeans":"No matching host in your range, or every match is 1.43.3.10861 or later.","notes":"Fingerprint only. Censys also wrote that about 30 percent of those hosts ran a vulnerable build. Do not treat a banner hit as proof of this CVE. Tune the organization field to your Censys schema. No sourced Shodan query was opened.","sources":[{"url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","date":"2026-10-20","publisher":"Censys"}]}],"limits":["No sourced Shodan fingerprint for this CVE. Do not invent one.","NAS package-manager versions may lag the Plex Downloads page.","A 1.43.3 banner can still be 1.43.3.10828, which is affected."],"sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","date":"2026-10-20","publisher":"Censys"}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"mitigations":{"summary":"Plex documents a reachability workaround: turn Remote Access off if you do not need it, and avoid forwarding the media port. That does not replace 1.43.3.10861.","items":[{"title":"Turn off Remote Access and stop forwarding the media port if you do not need it","detail":"Plex (19 Oct 2026): if you do not need remote access, turn it off under Settings, Remote Access. Avoid forwarding port 32400 directly unless you need it.","limits":"Not a software fix. Still upgrade to 1.43.3.10861. Internal paths remain in scope if an attacker can reach the host from another segment. A host that was reachable while vulnerable still needs review.","verify":"Untrusted networks can no longer complete a TCP connection to the media port. Confirm in the edge firewall or host ACL, then re-check after the next change window. Do not send crafted requests.","source":{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"response":{"summary":"If a host older than 1.43.3.10861 was reachable, preserve logs, isolate it, then rebuild from a clean install and rotate credentials the service account could reach. Plex and BoredHackerBlog name process and file artefacts; those lists rotate.","containment":[{"title":"Preserve logs and the data directory before you rebuild","detail":"Keep proxy, Zeek, DNS, and host logs from 16 Oct 2026, plus copies of Preferences.xml and the Codecs folder. Then isolate the host at the perimeter if you suspect compromise.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"title":"Rebuild from a clean installation","detail":"Plex: rebuild the server from a clean installation rather than reusing the old Plex data directory. At minimum, delete everything in the Codecs folder and check Preferences.xml for transcoder options you did not set. Then confirm the new install is 1.43.3.10861 or later.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"title":"Restrict Remote Access until the host is rebuilt","detail":"Plex: turn Remote Access off if you do not need it, and avoid forwarding port 32400. This is a reachability control during response, not a substitute for the rebuild.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]}],"rotate":[{"item":"Plex account password and every signed-in device","reason":"Plex: sign out of all devices from your Plex account settings, and change your Plex password.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"item":"Credentials, shares, and secrets the Plex service account could reach","reason":"Plex: treat anything the Plex service account could reach as potentially exposed, such as mounted shares and credentials stored on the same machine or VM. General: rotate after the host is rebuilt, not before.","generic":true,"sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]}],"persistence":[{"kind":"path","value":"Unexpected .so or .dll files in the Plex Codecs folder","detail":"Plex: unfamiliar shared libraries in Codecs. Actor tooling rotates.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"kind":"path","value":"TranscoderH264Options in Preferences.xml","detail":"Plex: transcoder options you did not set. ctxsec and Zach Main name dump-yuv as the string of interest.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"kind":"other","value":"myawesomeproxy, mylovelyminer, or x12345","detail":"Plex-named child processes. BoredHackerBlog recovered myawesomeproxy on one honeypot.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"}],"observedBehaviour":[{"title":"Cryptocurrency miners on compromised servers","detail":"Plex (19 Oct 2026): compromised servers have been used to run cryptocurrency miners. BoredHackerBlog recovered XMRig on one honeypot on 17 Oct 2026.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"},{"title":"Proxy software that routes other people's traffic","detail":"Plex: proxy software which routes other people's traffic through the victim's internet connection. BoredHackerBlog recovered myawesomeproxy and saw traffic related to proxystream.st.","sourceUrl":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","sourceDate":"2026-10-19"}],"evidence":[{"title":"Installed version string from before the upgrade","detail":"Preserve the Settings, General version so you can show whether the host was older than 1.43.3.10861 while it was reachable.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]},{"title":"Proxy, Zeek, DNS, and host logs from 16 Oct 2026","detail":"Keep /player/timeline records, sslip.io lookups, and process-creation events. BoredHackerBlog IPs are from one honeypot.","sources":[{"url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20","publisher":"ctxsec"}]},{"title":"Copies of Preferences.xml and the Codecs folder","detail":"Keep the files and their timestamps before a rebuild overwrites them.","sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"}]}],"limits":["BoredHackerBlog artefacts are from one honeypot. Plex says attacks are widespread; names still rotate.","No complete published attacker IP list beyond that honeypot.","A patch does not remove an implant already in Codecs or revoke a disclosed admin token."],"sources":[{"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-10-19","publisher":"Plex"},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","date":"2026-10-17","publisher":"BoredHackerBlog"},{"url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","date":"2026-10-20","publisher":"ctxsec"}],"updatedAt":"2026-11-01","addedDate":"2026-11-01"},"bulletins":[{"vendor":"Plex","title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-09-01","cve":"CVE-2026-96652"}],"coverage":[{"title":"Important Security Update for Plex Media Server v1.43.2 and earlier","publisher":"Plex","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","date":"2026-09-01","type":"vendor","addedDate":"2026-11-01"},{"title":"Plex2Shell","publisher":"Zach Main","url":"https://zmain.info/blog/plex2shell","date":"2026-10-16","type":"research","addedDate":"2026-11-01"},{"title":"Plex vulnerabilities being exploited in the wild to drop a cryptominer","publisher":"BoredHackerBlog","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","date":"2026-10-17","type":"research","addedDate":"2026-11-01"},{"title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog","date":"2026-10-20","type":"government","addedDate":"2026-11-01"},{"title":"VA-26-266-01","publisher":"CISA","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","date":"2026-09-23","type":"government","addedDate":"2026-11-01"},{"title":"October 20 Advisory: Plex Media Server Remote Code Execution Chain","publisher":"Censys","url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","date":"2026-10-20","type":"news","addedDate":"2026-11-01"},{"title":"CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","date":"2026-10-21","type":"news","addedDate":"2026-11-01"},{"title":"Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure","publisher":"SecurityWeek","url":"https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/","date":"2026-10-19","type":"news","addedDate":"2026-11-01"},{"title":"NVD CVE-2026-96652","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","date":"2026-09-23","type":"government","addedDate":"2026-11-01"}],"posts":[],"research":[{"title":"Plex2Shell","url":"https://zmain.info/blog/plex2shell","authors":"Zach Main","date":"16 Oct 2026"},{"title":"Important Security Update for Plex Media Server v1.43.2 and earlier","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","authors":"Plex (PlexInfo)","date":"1 Sep 2026, CVE update 19 Oct 2026 20:17 UTC"},{"title":"Plex vulnerabilities being exploited in the wild to drop a cryptominer","url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","authors":"BoredHackerBlog","date":"17 Oct 2026"},{"title":"Hunt: Plex2Shell exploitation of Plex Media Server","url":"https://ctxsec.com/items/hunt-plex2shell-exploitation.md","authors":"ctxsec","date":"18 Oct 2026, updated 20 Oct 2026"},{"title":"CISA KEV catalog JSON (all four CVEs listed; catalog 2026.10.30)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"dateAdded 20 Oct 2026, catalog 2026.10.30, checked 1 Nov 2026"},{"title":"NVD CVE-2026-96652 (Analyzed; CISA CNA CVSS 3.1 4.3)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","authors":"NVD / CISA CNA","date":"published 23 Sep 2026, lastModified 21 Oct 2026, checked 1 Nov 2026"}],"impact":{"kind":"single-product","product":"Plex Media Server","versions":[{"version":"Plex Media Server before 1.43.3.10861 (includes 1.43.3.10828)","status":"affected","versions":"1.43.3.10861","vendorStatement":{"date":"2026-10-19","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","quote":"Plex Media Server 1.43.3.10861 and later are not affected. If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised."},"statusLabel":"Affected when reachable (typically TCP 32400; no valid token required)","addedDate":"2026-11-01"},{"version":"Plex Media Server 1.43.3.10861 and later","status":"vendor-stated-not-affected","versions":"Not applicable (vendor)","vendorStatement":{"date":"2026-10-19","url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","quote":"Plex Media Server 1.43.3.10861 and later are not affected."},"addedDate":"2026-11-01"}]},"pocs":[{"title":"code-zm/plex2shell (for defenders)","url":"https://github.com/code-zm/plex2shell","source":"code-zm (Zach Main write-up links here)","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-18","notes":"Public repo created 18 Oct 2026 05:00 UTC. Zach Main write-up (16 Oct 2026) links here and scores the chain CVSS 3.1 9.8. Plex says a public PoC was released on 16 Oct 2026. BleepingComputer dates the PoC to 19 Oct 2026. BoredHackerBlog published a lab traffic capture and later saw in-the-wild use; that is not an independent validation of this repo as Public PoC: RCE under this site's rule. Index link only. This site does not republish exploit code or usage steps.","addedDate":"2026-11-01"},{"title":"gmh5225/plex2shell (for defenders)","url":"https://github.com/gmh5225/plex2shell","source":"gmh5225 (re-upload of Zach Main's code)","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-17","notes":"Appears to be a re-upload of Zach Main's code. Commits are authored by ZM, attributed by GitHub to the same account (code-zm) as code-zm/plex2shell, dated 16 Oct 2026 (first commit 16:41 UTC). Homepage points at the Zach Main write-up. Repo created 17 Oct 2026 01:44 UTC (pushed_at 16 Oct 2026 20:31 UTC). README claims CVSS 3.1 10.0; that score is unverified against NVD (CISA CNA per-CVE scores are 4.3, 6.5, 4.3, and 7.2). Not marked as a GitHub fork. Credit: Zach Main. Index link only. This site does not republish exploit code or usage steps.","addedDate":"2026-11-01"}],"pocEmptyState":"Two public repos are indexed. Validation status is unverified. A lab capture plus in-the-wild use is not treated as Public PoC: RCE under this site's rule.","_feed":{"page":"https://vuln2shell.com/vulns/plex2shell","json":"https://vuln2shell.com/vulns/plex2shell.json","iocsCsv":"https://vuln2shell.com/vulns/plex2shell/iocs.csv","stix":"https://vuln2shell.com/vulns/plex2shell/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public PoC (unverified RCE)"}}}