The Hacker News reported that attempts to exploit Plex2Shell began on October 17, 2026, targeting Plex Media Server with cryptocurrency-mining software and a Linux proxy backdoor. Plex had made the relevant fixed build, 1.43.3.10861, generally available on August 4.
What the Plex2Shell report describes
Plex2Shell is a chain of four vulnerabilities that can lead to remote code execution without authentication on affected Plex Media Server installations. The Hacker News reported that attackers used the chain to deliver a miner called x12345, an XMRig process named mylovelyminer, and myawesomeproxy, described as a Linux backdoor and reverse proxy. The outlet dated the reported attempts to October 17, one day after security researcher Zach Main published technical details.
The four vulnerabilities in the chain are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. CVE-2026-96651 was also disclosed, but is separate from those four.
Which Plex version includes the fixes?
Plex Media Server 1.43.3.10861 is the build Plex’s release notes identify with relevant security changes. Plex opened it to Plex Pass beta users on August 3, 2026, and made it generally available to everyone on August 4. The release notes list a fix for a potential CompanionProxy vulnerability and changes that prevent TranscoderH264Options and TranscoderH264OptionsOverride from being modified over the network.
In a September 1 security notice, Plex recommended Plex Media Server 1.43.3 or newer and Plex Desktop 1.115.0. Plex also said NAS owners might need to install a package manually if their vendor’s package manager had not yet made the update available. Its security update notice includes guidance for server owners and Plex Desktop users.
What access did the demonstration show?
Main’s technical demonstration ended with code running as uid=1000(plex), the Plex service account in his example. That is not root execution. The chain reaches remote code execution, but the demonstrated identity is a specific detail of Main’s example, not a claim that every affected server or operating system had the same outcome.
What Plex users reported
Reddit users described finding miner activity, including a report of the mylovelyminer process. The Hacker News reported those accounts separately from the Plex2Shell campaign and did not conclusively attribute them to the exploit. One user who described finding a DDoS bot said they rebuilt their Plex container and changed the Plex password after suspecting the account token had been stolen; that was an individual response, not Plex’s remediation guidance.
