Plex2Shell: your media server is now somebody else's crypto miner

Call: Patch now. Four Plex Media Server bugs (CVE-2026-96652, -96654, -96655, -96656) chain into unauthenticated code execution. Plex confirmed active, widespread exploitation on Oct 19, three days after a public proof of concept, and CISA added all four to KEV on Oct 20.

Fixed in: 1.43.3.10861. That build went public on Aug 4, so this is less a new patch than a bill coming due. If you’re on it, you’re fine. If your NAS package center says you’re current, check anyway: Settings > General in Plex Web shows the real version.

What attackers do: Steal the owner’s admin token, write a shared library into the Codecs folder, run it. Payloads seen so far are crypto miners and proxy software that rents out your home connection.

Who’s hit: Anyone with Remote Access on or port 32400 forwarded. Field Effect cites Shadowserver counting more than 36,000 exposed, unpatched servers in early September. Internal-only servers are still reachable from your own network.

If you were exposed while vulnerable, assume compromise. Plex’s IoCs: unfamiliar child processes (myawesomeproxy, mylovelyminer, x12345), unknown .so/.dll files in Codecs, transcoder options in Preferences.xml you didn’t set, traffic to proxystream.st, high CPU while nothing plays. Rebuild from a clean install, sign out all devices, change your Plex password, and treat any share the Plex account could reach as exposed. Then turn off Remote Access if you don’t actually stream away from home.

Sources: Plex advisory, CISA, Field Effect.