Vulnerabilities

Plex2Shell: public exploit turns old Plex servers into miners

By Yaali. October 20, 2026, 6 min read, Vulnerabilities, Threat intel, Patching.

A four-flaw chain gives unauthenticated code execution on Plex Media Server before 1.43.3.10861. Attacks began a day after the exploit went public.

On October 16, researcher Zach Main published a write-up and proof-of-concept code for Plex2Shell, a chain of four Plex Media Server flaws that ends in code execution without a login. The next morning he reported that an internet-facing Plex honeypot running an old build had been hit with the published exploit and loaded with an XMRig cryptocurrency miner and a proxy tool.

Any Plex Media Server older than 1.43.3.10861 that untrusted networks can reach is at risk. Plex shipped the fix in that build on August 3 and asked owners to update on September 1, but many installs only update when someone remembers to: NAS packages, Docker containers pinned to an old tag, and home servers port-forwarded on TCP 32400. Plex often runs on a spare box inside an office or on a staff member's home network next to a work laptop, so check its version today.

How the chain works

Plex Media Server exposes three things that matter here. A companion API lets phones and TVs act as remote controls. An internal plugin API is meant to answer only the server itself, on the loopback address 127.0.0.1. A transcoder converts video on the fly and loads codec libraries from a Codecs folder in the Plex data directory. Each flaw moves the attacker one level deeper.

CVE-2026-96652, CVSS 5.3. A server-side request forgery (SSRF) bug in the companion API: an unauthenticated request can make the server send requests to an address the attacker picks. Pointed at 127.0.0.1, it reaches the internal plugin API, which trusts anything that appears to come from the server itself.

CVE-2026-96654. Inside that plugin API, an authorisation check that never takes effect and a URL injection let the attacker get the server owner's admin token sent to a host they control. That token is the owner's full credential for the server.

CVE-2026-96655 and CVE-2026-96656 (CVSS 8.6). With the owner token, the attacker uses the transcoder to write a file to a path of their choosing, then sets a transcoder preference that the server passes on without sanitising it. Plex loads shared libraries (.so files) from its Codecs folder without checking signatures or expected symbols, so a planted library runs inside the Plex process. Code runs with the rights of the Plex service account, which on most Linux installs can read the whole media library and anything else that account can reach.

The individual scores understate the risk. The researcher's repository rates the whole chain as critical, and no single link needs credentials once the first one is in place. We could not confirm a score for CVE-2026-96654 or CVE-2026-96655 in two sources, so we leave them out.

Sources disagree on two details. The repository says versions before 1.43.3.10828 are affected, while the CVE records and SentinelOne's database say before 1.43.3.10861; treat everything older than 1.43.3.10861 as vulnerable. Some coverage also lists CVE-2026-96651 (CVSS 7.1). That is a separate path traversal flaw, fixed in the same build, that lets an attacker read files the Plex user can access, including the PlexOnlineToken that controls the linked Plex account. It sits outside the four-step chain, and any server older than 1.43.3.10861 has it as well.

What attackers are doing

The only confirmed exploitation so far is on the researcher's honeypot, compromised on October 17, about a day after the write-up went public. The first payload, named mylovelyminer, is built on XMRig and mines Monero with the server's CPU. A second program, myawesomeproxy, arrived later that day. When run, it prints a notice that running it means agreeing to the external use of your internet traffic; The Hacker News, citing VirusTotal, describes it as a Linux backdoor and reverse proxy.

The proxy is the more serious of the two for a business. It lets other people route traffic through your home or office IP address, which looks like a normal residential or company connection to the services they reach, including VPN gateways and mail systems.

Plex users on Reddit have reported servers running slow and hot with a process called mylovelyminer, and Neowin covered those reports. Whether all of those infections came through Plex2Shell has not been confirmed. Plex has not issued a new statement about the October attacks in the coverage we found, and the CVEs were not in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

What to do

1. Find every Plex server. Include NAS appliances, Docker hosts and media boxes that IT did not set up. The version is shown in Settings under General, and the /identity page on port 32400 reports it too.
2. Update to 1.43.3.10861 or later. On a NAS, pull the new package from the vendor's package centre. For Docker, pull the current image and recreate the container; restarting an old container keeps the old build.
3. If you cannot update today, stop forwarding TCP 32400 on the router or firewall, and reach the server through a VPN instead. This cuts off the unauthenticated first step from the internet, but anything on the local network can still try it, so it only buys time.
4. Check for compromise on any server that was reachable and older than 1.43.3.10861 after October 16:
   • list the Codecs folder in the Plex data directory and look for .so files with recent dates or names that do not match the codecs Plex downloaded;
   • look for child processes of Plex Media Server that are not the transcoder, and for process names or command lines containing mylovelyminer, myawesomeproxy or XMRig options such as --rig-id;
   • check for sustained high CPU when nothing is being streamed, and for outbound connections from the Plex host you cannot explain;
   • check the transcoder settings for an H.264 options value nobody on your side entered.
5. Clean up if you find anything. The attacker held the owner token and ran code as the Plex user, so a patch alone does not remove them. Rebuild the host or container from a clean image, restore only the media and a known-good configuration, then change the Plex account password and sign out all connected devices so stolen tokens stop working. Rotate any other credentials that the Plex service account could read.

The wider lesson

Plex shipped this fix in August and the exploit only went public in October. The attacks came because servers stayed on old builds for two months after the fix existed. Self-hosted software that a person installed for themselves rarely shows up in an asset inventory or a patch report, yet it often listens on the internet with a forwarded port. If your vulnerability scans only cover hosts in the CMDB, they will miss it.

Finding forwarded ports and forgotten services is where our attack surface management work starts, and our safeguarding and hardening work covers keeping them updated. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: The Hacker News, SecurityWeek, Security Affairs, Cyber Security News, Zach Main's write-up, Plex2Shell repository, SentinelOne on CVE-2026-96652, SentinelOne on CVE-2026-96656, SentinelOne on CVE-2026-96651, Neowin.