psf-plex2shell-oct2026-check(8)

Script: /opt/psf-security-patches/plex/plex2shell-oct2026-check.sh. Tool page: Plex Media Server. Source. With the package installed: man psf-plex2shell-oct2026-check.

Plex Media Server "Plex2Shell" RCE chain: check and hunt  (v1)
CVE-2026-96651 CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

"Plex2Shell" chains flaws in Plex Media Server into unauthenticated remote
code execution: an SSRF on /player/timeline (CVE-2026-96652), an admin-token
theft via searchOne (CVE-2026-96654), a second SSRF on the transcode path
(CVE-2026-96655), and a file write into the Codecs directory that drops and
runs an ELF shared object (CVE-2026-96656); CVE-2026-96651 was fixed in the
same release. Plex fixed all of them in Plex Media Server 1.43.3.10861 (3
August 2026). A public proof-of-concept landed on 16 October 2026 and
exploitation began the next day: attackers drop an XMRig miner (seen as
"mylovelyminer", fetched as "x12345") and a reverse-proxy backdoor
("myawesomeproxy"), with mining and proxy traffic to proxystream[.]st.

The fix is to upgrade to 1.43.3.10861 or later (including NAS, Docker and VM
installs) and restart, which this script does not do for you. It is
read-only: it reports the Plex version on the host and in containers and
judges it, and hunts for the known compromise indicators. Successful
exploitation runs code as the Plex service account, so if this host was
exposed and unpatched, treat it as compromised: rebuild from a clean install,
rotate the Plex account credentials and server token, and remove
any router port-forwarding to Plex until it is updated. Attackers rotate file
names, domains and ports, so a clean hunt means none of the published indicators were found; the version is the reliable signal.

Usage:
  ./plex2shell-oct2026-check.sh [command]

  check (default)  the Plex Media Server version on the host and in running
                   containers, judged against 1.43.3.10861. Read-only, root
                   optional. Exit 0 = fixed/none, 1 = a vulnerable Plex is
                   present, 2 = a version couldn't be read.
  hunt             read-only: Plex data directories, /tmp and logs for the
                   known indicators (the miner and proxy file names, the
                   Codecs-directory payload, the proxyware banner, the mining
                   domain and attacker IPs) and for the miner/proxy running.
                   Exit 0 = clean, 1 = findings.
  version          print the script version.

Env overrides:
  PLEX_FIXED=1.43.3.10861           first fixed Plex Media Server build
  PLEX_DATA_PATHS="/var/lib/plexmediaserver ..."
                                    where to look for Plex data directories
  SCAN_CONTAINERS=1                 1 = read the Plex version inside containers
  HUNT_LOGS="/srv/app/log/*.log"    extra log globs for hunt
  SCAN_DEPTH=7                      how deep the search for Plex data directories goes
  CODECS_SINCE_DAYS=30              how far back hunt lists changed files in the
                                    Codecs directory
  HUNT_ROOTS="/tmp /var/tmp /dev/shm"
                                    scratch directories hunt searches for payload
                                    files and indicator strings

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.