---
title: 'Plex2Shell Plex Media Server chain widely exploited; Plex says exposed older servers may be compromised'
url: 'https://securteksecurity.com/news/plex2shell-plex-media-server-chain-widely-exploited'
markdown: 'https://securteksecurity.com/news/plex2shell-plex-media-server-chain-widely-exploited.md'
date: '2026-10-20'
description: 'Plex updated its security notice on October 19, 2026 to state that four flaws in Plex Media Server, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, chained together as Plex2Shell, are being actively and widely exploited. Chained, the flaws let an unauthenticated remote attacker r…'
taxonomy:
  category:
    - Cybersecurity
---

# [Plex2Shell Plex Media Server chain widely exploited; Plex says exposed older servers may be compromised](https://securteksecurity.com/news/plex2shell-plex-media-server-chain-widely-exploited)

   20th Oct 2026  

Plex updated its security notice on October 19, 2026 to state that four flaws in Plex Media Server, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, chained together as Plex2Shell, are being actively and widely exploited. Chained, the flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. They were fixed in Plex Media Server 1.43.3.10861. A public proof of concept was released on October 16, and Plex said it has since seen widespread attacks against internet facing servers that had not been updated, with compromised servers used to run cryptocurrency miners and proxy software.

Censys, in an advisory on October 20, 2026, said it observes roughly 324,000 hosts running Plex Media Server, about 30 percent of them running a vulnerable build, with the United States accounting for about 44 percent. Plex advised that any server older than 1.43.3.10861 that was reachable from the internet should be treated as one that may be compromised, and recommended a clean reinstall, clearing the Codecs folder, checking Preferences.xml for transcoder options that were not set by the owner, signing out all devices, and changing the Plex password. Upgrading alone does not remove an implant already placed in the Codecs folder or revoke a disclosed admin token.

Update, October 20: CISA added all four Plex2Shell flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, with a federal remediation deadline of October 23, 2026. The KEV listing is recorded in a separate item on this page that also covers the SiteGuard and Siemens additions in the same batch.

Sources: [Plex](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319); [Censys](https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/); [The Hacker News](http://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html); [SecurityWeek](https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/); [CISA](https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [PingCAP confirms TiDB Cloud breach: stolen credentials used to copy customer data and source code](https://securteksecurity.com/news/pingcap-tidb-cloud-breach-stolen-service-account-credentials-source-code.md)
- Next: [Poll: most voters see AI as a job risk, want regulation](https://securteksecurity.com/news/poll-most-voters-see-ai-as-a-job-risk-want-regulation.md)