CISA Orders Urgent Plex2Shell Patch as Hackers Turn Plex Servers Into Crypto Miners

Four small Plex flaws chain into full remote control — and internet-facing home servers may already be compromised

October 21, 2026 — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the four Plex Media Server flaws known as Plex2Shell to its Known Exploited Vulnerabilities (KEV) catalog. Chained, they let a remote attacker with no account and no password run code on a vulnerable server. Plex says compromised servers have run cryptocurrency miners and proxy software, and any pre-1.43.3.10861 server reachable from the internet should be treated as possibly compromised.

Image: A home media server under attack, shielded by a warning lock as miner and proxy traffic is blocked. Credit: AI-generated illustration / Red Eye Eagle News.

Editor's Highlight: The fix has existed since the summer — what changed is proof of exploitation. Exploit code appeared October 16, a honeypot was hit October 17, Plex confirmed "active and widespread" exploitation October 19, and CISA listed the flaws October 20. Updating alone is not enough: check for implants an update does not remove.

Table of Contents

• Key Facts
• What CISA Added — and the October 23 Deadline
• How the Plex2Shell Chain Works
• Miners, Proxies and the Signs of Compromise
• How Many Servers Are Still Exposed
• What Plex Owners Should Do Now
• Bottom Line
• FAQ
• Sources

Key Facts

What happened	CISA added the four Plex2Shell flaws to its KEV catalog on October 20, 2026
Affected software	Plex Media Server before 1.43.3.10861, including NAS and Docker
The flaws	CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Attack result	Unauthenticated remote code execution as the Plex process
Seen in attacks	Cryptocurrency miners and proxy software
Fixed version	Plex Media Server 1.43.3.10861 or later
First federal deadline	October 23, 2026 for two flaws; the rest by November 3

What CISA Added — and the October 23 Deadline

On Tuesday, October 20, CISA added six vulnerabilities to the KEV catalog, according to The Hacker News. Four are the Plex2Shell chain. The other two are a Siemens Software Center DLL sideloading flaw (CVE-2026-110936, CVSS 8.4) and a SiteGuard command injection flaw (CVE-2026-106931, CVSS 8.5).

KEV listing is not a theoretical warning. It catalogs flaws with evidence of active exploitation and carries binding deadlines for Federal Civilian Executive Branch (FCEB) agencies: fixes for CVE-2026-96656, CVE-2026-96654 and SiteGuard by October 23, 2026, the rest by November 3, 2026. Home owners face no federal deadline — but attackers are not waiting.

Tech Analysis: The two Plex flaws due first are the end of the chain — the steps turning access into code execution. CISA wants the most dangerous links closed immediately.

How the Plex2Shell Chain Works

Security researcher Zach Main discovered and reported the four flaws, which chain into unauthenticated remote code execution — full control, no login required.

Censys, in its October 20 advisory, explained how. An unauthenticated request to the /player/timeline endpoint makes the server issue requests for the attacker. A crafted value forces a request to an internal agent over loopback, and Plex attaches the owner's admin token. With it, the attacker sets transcoder options so a crafted video writes a malicious shared object into the Codecs directory — loaded without signature checks.

CVE	Flaw type	CVSS (per The Hacker News)
CVE-2026-96652	Server-Side Request Forgery (SSRF)	5.3
CVE-2026-96654	Improper neutralization of encoded URI schemes	6.9
CVE-2026-96655	Server-Side Request Forgery (SSRF)	5.3
CVE-2026-96656	External control of file name or path	8.6

Individually, the first three flaws look modest. Together they hand an unauthenticated stranger the owner's admin token, then a way to run code. Per BetaNews: reported July 27, CVEs assigned September 23, exploit code published October 16.

Miners, Proxies and the Signs of Compromise

The KEV listing follows a report from researcher boredhackerblog, who found threat actors weaponizing the flaws to deploy cryptocurrency miners and proxy malware. Censys reported the same pattern. A miner steals electricity; a proxy is worse — it relays other people's traffic through the victim's connection.

Plex listed these signs, via BetaNews and Censys:

• Unfamiliar processes started by Plex, especially myawesomeproxy, mylovelyminer or x12345
• Unfamiliar .so or .dll files in the Plex Codecs folder
• Outbound connections to proxystream.st
• Sustained high CPU use while nothing is playing

Tech Analysis: Upgrading closes the chain, but Censys noted it does not remove an implant in the Codecs directory or revoke a stolen admin token. A patched server can still be compromised.

How Many Servers Are Still Exposed

Censys observes roughly 324,000 hosts running Plex Media Server — the largest networks are residential broadband providers, the United States accounts for about 44 percent, and about 30 percent run a vulnerable build. Nearly 8,000 hosts run early build 1.43.3.10828 — the hosts most likely to be mistaken for patched.

What Plex Owners Should Do Now

These steps follow Plex's guidance, via Censys and BetaNews:

• Check your version. In Plex Web: Settings, then General. You need 1.43.3.10861 or later — the full build number. NAS, Linux and Docker need a manual update.
• Look for warning signs. Check the Codecs folder, process list and outbound connections.
• If in doubt, rebuild cleanly. Plex recommends a clean reinstall — at minimum, clear the Codecs folder and check Preferences.xml for transcoder options you did not set.
• Reset account access. Sign out all devices and change your password; the chain can expose the admin token.
• Think beyond Plex. Treat mounted shares and credentials on the same machine as exposed.
• Close what you do not use. Turn off remote access if unneeded; avoid forwarding port 32400.

Practical Takeaway: Check today, even if you updated in September: 10861 is fixed, 10828 is not. If the server was old and internet-reachable, finish with the compromise checks.

Bottom Line

Four modest flaws chain into unauthenticated remote control, the exploit is public, and CISA has confirmed exploitation. The fix is build 1.43.3.10861 — but internet-facing servers must also be verified clean. Watch whether the vulnerable share falls, and whether agencies meet the October 23 and November 3 deadlines.

FAQ

What is Plex2Shell?

The name for four chained Plex vulnerabilities — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — allowing unauthenticated remote code execution.

Which Plex versions are safe?

1.43.3.10861 and later, according to Plex as reported by BetaNews. Anything earlier is vulnerable — including build 10828, flagged by Censys.

I already updated. Am I done?

Not necessarily, if your server was old and internet-reachable. Upgrading does not remove an implant in the Codecs folder or revoke a disclosed token, Censys noted. Check for compromise; in doubt, rebuild cleanly.

What are attackers installing?

Cryptocurrency miners and proxy software, per Plex's October 19 update via Censys and The Hacker News.

Does the CISA deadline apply to home users?

No — the October 23 and November 3 deadlines bind federal agencies. But the same flaws are being exploited against home and NAS servers now.

Sources

• The Hacker News — CISA Orders Federal Agencies to Patch Exploited Plex2Shell Flaws: https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html
• Censys — Plex Media Server Remote Code Execution Chain advisory: https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/
• BetaNews — Plex confirms active exploitation, publishes four CVEs: https://betanews.com/article/plex-cve-exploit-active/
• Image: AI-generated illustration / Red Eye Eagle News