Plex2Shell Vulnerability Threatens 49,000 Plex Servers – Urgent Update Warning Ahead of November 3

A critical vulnerability chain named Plex2Shell is currently being scanned on a large scale by hacker groups, directly threatening over 49,000 Plex servers. Notably, attackers can take full control of the system without requiring any login credentials. If you or your organization uses a Plex server, here is the necessary information and action needed to mitigate the risk immediately.

What is the Plex2Shell attack chain and how does it work?

Plex Media Server is widely known as a popular media management and streaming platform (movies, music, photos) with over 25 million global users as of 2025. Recently, this system has been facing Plex2Shell—a chain of 4 critical security vulnerabilities. The danger of this vulnerability chain is that it allows attackers to execute Remote Code Execution (RCE) completely unauthenticated on unpatched servers.

• Vulnerability: CVE-2026-96652
  • CVSS Score: 7.1/10
  • Stage 1: Stealing the Admin authentication token
• Vulnerability: CVE-2026-96654
  • CVSS Score: 7.5/10
  • Stage 2: Exploiting the vulnerability to force the system to download a malicious file remotely.
• Vulnerability: CVE-2026-96655
  • CVSS Score: 7.5/10
  • Stage 3: Writing the malicious file to the application directory
• Vulnerability: CVE-2026-96656
  • CVSS Score: 8.6/10
  • Stage 4: Executing malicious code and taking control

The attack scenario unfolds completely automatically in just a few seconds:

1. Extracting the auth token: Hackers send a crafted request to the /player/timeline endpoint. The Plex application is tricked and inadvertently responds with the Admin account’s authentication token.
2. Downloading malware: Using the newly acquired token, the attacker commands Plex to download a malicious file (.so format) from a server under their control onto the Plex server in preparation for the next attack step.
3. Unauthorized file writing: The malicious file is dropped directly into Plex’s data or plugin directory.
4. Taking control: Plex automatically loads and activates this malicious file, granting the hacker remote code execution (RCE) capabilities.

Since the sole condition to trigger the attack chain is port 32400—the primary service port of Plex Media Server accessible from the Internet—any server with the Remote Access feature enabled that remains unpatched is an easy target for “vulnerability.”

Why are there still 49,000 unpatched servers?

Although developers released a fix on August 3, 2026, internet scanning data from mid-October shows that approximately 49,000 Plex servers still have not been upgraded. This is due to three main factors:

• No accompanying urgent warning: The patch was released in August without an accompanying security advisory bulletin, causing many administrators to overlook this information in the release notes.
• Complacency regarding “firewalls”: Many users assume that firewalls protect them and therefore always keep remote access enabled, leaving an “open door” for hackers to infiltrate.
• Vague notifications: Initial update notifications used mild terminology, leading the user community to mistakenly believe this was merely an optional feature update.

Plex Media Server today is no longer limited to household scales. It appears widely in small and medium-sized enterprises (for internal video sharing), schools, and even medical facilities (for viewing DICOM images). Delayed updates are turning these environments into “easy prey” for hackers.

What do hackers do after taking over a Plex server? Findings from honeypot systems confirm that current Plex2Shell attacks automatically deploy two types of dangerous payloads:

• Cryptojacking malware (mylovelyminer): Automatically installs the Monero (XMRig) mining tool, silently draining CPU/RAM resources, leaving the server constantly overloaded, lagging, or hanging.
• Proxy malware (myawesomeproxy): Enrolls the victim’s server into the AISURU botnet. This network specializes in reselling hijacked bandwidth to serve credential-stuffing campaigns or anonymize malicious cyber activities.

Threat to businesses: A dangerous blind spot in IT management

In many organizations, media entertainment software like Plex falls outside standard vulnerability management catalogs. IT departments often view this as an employee’s personal application, while employees assume IT has secured the entire infrastructure.

This very “responsibility gap” makes Plex2Shell more effective than ever. More dangerously, when a Plex server in an internal network is turned into a node within the AISURU botnet, bad actors can use the business’s internal IP address to launch reverse attacks against identity management systems like Okta or Microsoft Entra ID.

The Cybersecurity and Infrastructure Security Agency (CISA) has added these 4 CVEs to its binding operational directive list with a deadline of November 3, 2026.

Conclusion

In summary, the Plex2Shell vulnerability chain is turning every unpatched Plex Media Server into an easy target for hackers without requiring any password. Within just 24 hours of exploit proof-of-concept code appearing, bad actors quickly leveraged this weakness to plant cryptojacking malware or turn systems into malicious intermediary networks. According to statistics, up to 49,000 global servers remain unpatched, making any Plex system directly connected to the Internet a target. Therefore, upgrading immediately to version 1.43.3.10861 today is the safest way to close all risk windows for your Plex server.

Read more about the PHP2Shell vulnerability: PHP2Shell: Làn sóng thử khai thác tăng mạnh, máy chủ web đối mặt nguy cơ bị lôi kéo vào botnet