Content management and web applications
Plex Media Server: Plex2Shell chain
Plex Media Server Plex2Shell RCE Chain
"Plex2Shell" chains flaws in Plex Media Server into unauthenticated remote code execution. The chain is an SSRF on /player/timeline (CVE-2026-96652), admin-token theft via searchOne (CVE-2026-96654), a second SSRF on the transcode path (CVE-2026-96655), and a file write into the Codecs directory that drops and runs an ELF shared object (CVE-2026-96656). CVE-2026-96651 was fixed in the same release. Plex fixed all of them in Plex Media Server 1.43.3.10861 (3 August 2026). A public proof-of-concept landed on 16 October 2026 and exploitation began the next day: attackers drop an XMRig miner (seen as mylovelyminer, fetched as x12345) and a reverse-proxy backdoor (myawesomeproxy), with traffic to proxystream[.]st.
The fix is to upgrade to 1.43.3.10861 or later, including NAS, Docker and VM installs, and restart, which this script does not do for you. It is read-only. Successful exploitation runs code as the Plex service account, so if this host was internet-exposed and unpatched, treat it as compromised: rebuild from a clean install, rotate the Plex account credentials and server token, and remove any router port-forwarding to Plex until it is updated. Attackers rotate file names, domains and ports, so a clean hunt means none of the published indicators were found. The version is the reliable signal.
Plex quick start
-
Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.
# BASE from GitHub: https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main # curl -fLO "$BASE/plex/plex2shell-oct2026-check.sh" curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/plex/plex2shell-oct2026-check.sh -
Read it before running it, then make it executable.
less plex2shell-oct2026-check.sh chmod +x plex2shell-oct2026-check.sh -
Check the Plex version.
sudo ./plex2shell-oct2026-check.sh check -
Hunt the indicators.
sudo ./plex2shell-oct2026-check.sh hunt
Plex commands
| Command | What it does |
|---|---|
check (default) |
Reports the Plex Media Server version on the host (from the package or the install) and in running containers, judged against 1.43.3.10861. Read-only, root optional. Exits 0 if fixed or not present, 1 if a vulnerable Plex is present, 2 if a version couldn't be read |
hunt |
Read-only. Scans Plex data directories, /tmp and scratch dirs for the known payload file names, lists recently changed files in the Codecs directory (where CVE-2026-96656 writes), greps files for the proxyware banner and mining domain, checks for the miner/proxy running, and scans logs for the attacker IPs and mining domain. Exits 0 if clean, 1 if it found something |
version |
Prints the script version. Every command prints it on its first line too |
Plex patch detection
Plex Media Server versions look like 1.43.3.10861-xxxxxxxxx. The script reads the numeric build (from the plexmediaserver package, or a version file in the install, or inside a container) and compares it to 1.43.3.10861. Anything earlier is vulnerable to Plex2Shell. Plex's own auto-update covers only Windows and macOS, so on GNU/Linux, NAS and Docker you upgrade through your package manager, a container pull and recreate, or a manual download, then confirm the running build.
Before you run it
- The fix is upgrading; this script only tells you where you stand. Upgrade to 1.43.3.10861 or later on every install (NAS, Docker and VM included) and restart.
- An exposed, unpatched server should be treated as compromised. The chain runs code as the Plex service account. Rebuild from a clean install, rotate the Plex account credentials and server token, and remove port-forwarding to Plex until it is updated.
- Indicators change. Attackers rotate file names, domains and ports, so the hunt can miss a renamed payload. A clean hunt means none of the published indicators were found. The version is the reliable signal.
- The Codecs listing is a review aid, not a verdict. Plex's own codecs are ELF shared objects too, so the script lists what changed there recently rather than flagging every shared object as malware.
- Containers carry their own Plex. Pull a fixed image and recreate the container. A restart alone does not change the build.
- GNU/Linux only , and it finds data directories under the scanned paths. Point
PLEX_DATA_PATHSat a library kept elsewhere. HUNT_ROOTSsets the scratch directorieshuntsearches for payload files and indicator strings (default/tmp /var/tmp /dev/shm, plus the Plex data directories it finds).- The script does not report itself. Its own file names the indicators, so the exact running file is left out of the content search. A different copy of the script saved under a scanned directory is still reported.
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
