UPDATE 17–19 October 2026: researcher Zach Main published the Plex2Shell write-up and proof-of-concept code on 16 October, showing how four of the flaws chain into unauthenticated remote code execution on Plex Media Server before 1.43.3.10861: the /player/timeline SSRF (CVE-2026-96652) is used to call searchOne (CVE-2026-96654) and obtain the owner's admin token, the transcoder SSRF (CVE-2026-96655) fetches an attacker-hosted file, and the Codecs path flaw (CVE-2026-96656) writes it as a shared object that Plex then runs.

The fixes shipped in PMS 1.43.3.10861 on 3 August, after Zach Main reported the bugs to Plex on 27 July. Researcher boredhackerblog reported in-the-wild exploitation of a honeypot from the morning of 17 October, first from 45.194.92[.]222 and also from 91.92.40[.]202 and 176.65.139[.]228, which downloaded payloads from 217.60.194[.]116: an XMRig miner (seen as 'mylovelyminer', mining to ota.proxystream[.]st) and a Linux reverse-proxy backdoor called 'myawesomeproxy' (SHA-256 e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9).

Bitsight linked another proxystream[.]st subdomain to the AISURU DDoS and proxyware botnet in August. Plex users on Reddit report servers infected with the same miner, though it is not confirmed those infections came from Plex2Shell.

Zach Main has published detection guidance and boredhackerblog has published packet captures. Plex had not commented by 19 October (The Hacker News).

UPDATE 23–24 September 2026: NVD and CISA CSAF VA-26-266-01 (published 23 Sep 2026) assign five CVEs to Plex Media Server before 1.43.3.10861 — the build family covered by Plex’s 1 September 2026 forum security notice (PMS 1.43.3 / Desktop 1.115.0) that previously said CVEs were requested but withheld. CVE-2026-96656 (CVSS 3.1 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): admin can write arbitrary files via TranscoderH264Options appended to x264; .so files run at startup without signature checks.

CVE-2026-96651 (6.5 Medium): path traversal on /system/agents/media/get can read files including PlexOnlineToken (account/server control) with a valid session token. CVE-2026-96654 (6.5): unauth URL injection via searchOne into other plugins. CVE-2026-96652 / CVE-2026-96655 (4.3): SSRF via /player/timeline and transcoder universal path.

BleepingComputer reported on 9 September 2026 that Shadowserver said over 36,000 internet-exposed Plex Media Server instances were still unpatched against the flaws in v1.43.2 and earlier. Patch: PMS ≥1.43.3.10861 / Desktop ≥1.115.0; confirm auto-updates landed.

UPDATE (22 Oct 2026): CISA added CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to its Known Exploited Vulnerabilities catalog on 20 October 2026 (US federal due dates 23 October for -96654 and -96656, 3 November for -96652 and -96655). (source: CISA KEV catalog)