In a report published October 19, 2026, Ars Technica said an unnamed researcher observed scans of a simulated Plex Media Server within a day of setting up a honeypot, followed by successful infections. The reported payloads included a cryptominer and residential-proxy software.
NeoTeo previously covered reported Plex2Shell exploitation attempts in its earlier report. Ars Technica’s account adds observations from the simulated server.
What the Plex2Shell honeypot observed
The honeypot ran a simulated Plex Media Server. Scanning began within a day of setup, according to Ars Technica’s account of the researcher’s findings. Later infections involved a cryptominer and software that turns a residential connection into a proxy endpoint.
Those payloads can put a server’s computing resources or network connection to use for someone else’s purposes. The reported observation concerns the simulated server; it is not a count of affected Plex installations.
How the researcher described the vulnerability chain
The researcher named the four-vulnerability chain Plex2Shell and listed CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The researcher assigned the chain a CVSS v3.1 score of 9.8.
At a high level, the researcher described a sequence starting with an unauthenticated server-side request forgery, or SSRF. That flaw can make a server send an unintended request. The chain then pivots to a service on the same machine, steals an owner token, delivers a payload through transcoding, and reaches remote code execution. The researcher said execution ran as the Plex service account.
In the researcher’s account, the vulnerabilities were reported to Plex on July 27, 2026; Plex acknowledged the report and paid a bounty on August 4; four CVEs were assigned on September 23; and the researcher publicly disclosed the chain on October 16.
Which updates Plex recommends
Plex’s September 1, 2026 security notice recommends Plex Media Server 1.43.3 or newer and Plex Desktop 1.115.0. The recommendations apply to separate applications, so check the server and desktop versions independently. Plex’s security notice also says the server package for a NAS may not yet appear in its package manager. In that case, Plex directs owners to download the package for their device and follow the NAS manufacturer’s installation procedure.
How to reduce remote-access exposure
Ars Technica’s security guidance recommends restricting Plex Media Server to local-network access where feasible. If you need remote access, it recommends using a reverse proxy rather than exposing the default port, 32400, directly. The guidance also calls for secure Plex apps and strong passwords.
