Plex2Shell Vulnerability: Attackers Are Hitting Unpatched Plex Media Servers With Crypto Miners and Proxy Software, and the Build to Install

Attackers are breaking into Plex Media Servers that have not been updated, using a public exploit chain called Plex2Shell, and Plex says the attacks are active and widespread. If anyone at your company runs Plex on a server, a desktop or a network storage box that can be reached from the internet, update it today and check it for signs of a break-in, because updating alone does not clean up a server that was already hit.

What is the Plex2Shell vulnerability?

Plex2Shell is the name for four flaws in Plex Media Server that work as a chain. Plex says that, chained together, they let a remote attacker with no login run code with the privileges of the Plex Media Server process.

The researcher's write-up describes the path. A request to port 32400 passes a token check that only looks for whether a token exists. The server is tricked into calling itself, the owner's admin token leaks to the attacker, and that token is used to plant a malicious file in the Codecs folder. The file runs the next time Plex transcodes a video.

Which Plex versions are affected?

Plex's advisory says Plex Media Server 1.43.3.10861 and later are not affected. Its title names v1.43.2 and earlier, and its October 19 update tells owners of anything older than 1.43.3.10861 to act. Check the full build number, not just "1.43.3".

QNAP's operating systems, QTS and QuTS hero, are not themselves affected, according to QNAP's FAQ. The flaw is in the Plex app running on the NAS. The FAQ also says not to wait for later releases, because 1.43.3 already fixes Plex2Shell.

What is confirmed and what is not

Confirmed by Plex. The vulnerabilities are "being actively and widely exploited." A public proof of concept came out on October 16, 2026, and Plex says internet-facing servers that had not been updated have seen widespread attacks since then. Compromised servers have been used for cryptocurrency mining and for proxy software.

Confirmed in CISA's data. All four CVEs were added to the Known Exploited Vulnerabilities list on October 20, 2026. The due dates for US federal agencies were October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for CVE-2026-96652 and CVE-2026-96655. Both dates have passed. The ransomware field for all four reads "Unknown".

The timeline. The researcher reported the flaws to Plex on July 27, 2026, and Plex acknowledged the report and paid a bounty on August 4. Plex announced 1.43.3 on September 1 without details, and the CVEs were assigned on September 23. The write-up went public on October 16. Anyone who updated promptly in September was ahead of the public exploit by about six weeks.

Reported, but not something we could read at the source. BleepingComputer reports that QNAP's November 6 security notice says some users' Plex installations appear to have been compromised and that QNAP support is helping them. The notice page would not load for us, so we are relying on that report for this one point.

Not known. Plex gives no count of affected servers. The Plex and QNAP pages we read do not say who is behind the attacks, and they do not describe specific cases of stolen data. They do tell owners to treat what Plex could reach as potentially exposed.

Why a media server matters on a company network

Plex is consumer software, so it often never makes it onto the asset list. It may sit on a NAS that also holds shared folders, or on a machine someone set up for a break room or a training library. Attackers do not care what the box is for.

A miner burns your electricity and hardware. Proxy software is the more awkward one, because it can send other people's traffic out through your internet connection. The larger concern is reach: Plex tells owners to treat anything the service account could reach as potentially exposed, and QNAP extends that to shared folders and stored credentials on the NAS, including those used by backups and cloud services.

How to check if your Plex server was hacked

Plex and QNAP list these signs:

• Unrecognized processes started by Plex Media Server. QNAP names myawesomeproxy, mylovelyminer and x12345 as examples.
• Unfamiliar .so or .dll files in the Codecs folder.
• Outbound connections to proxystream.st.
• High CPU use while nothing is playing.
• On QNAP, a Malware Remover detection, for example code MR2104.

QNAP says that if you find any of these, do not just delete the program. Do the full reinstall and credential reset.

What to do this week

Plex2Shell questions people are asking

Is updating Plex enough?

Only if the server was never reachable from the internet. QNAP says updating alone is sufficient in that case. If it was reachable while on a vulnerable version, plan for the compromise check, clean reinstall and credential reset.

My QNAP NAS is already updated. Am I in the clear?

Not automatically. QNAP's test is whether Plex was reachable from the internet while running 1.43.2 or earlier: Remote Access enabled, port 32400 forwarded, UPnP opening the port with Remote Access on, or exposure through myQNAPcloud or another method. The FAQ sets no cutoff based on when you upgraded. If any of those applied, QNAP says to treat the NAS as potentially compromised.

What does Plex say about a server that is still unpatched?

"If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised."

Do attackers need a Plex login?

No. Plex says the chain works for an unauthenticated remote attacker. The researcher's write-up says a junk token is enough to pass the first check.

Do I have to shut down Plex?

Plex's advice is to update and to turn off remote access if you do not need it. If you cannot update right away, taking the server off the internet until you can is the sensible stopgap.

The bigger lesson

The fix for Plex2Shell was available weeks before the exploit was. The servers now in trouble are mostly the ones nobody was assigned to update, which is a question of ownership more than technology. Every service your business exposes, including the ones that feel like a side project, needs a named person who patches it and confirms the patch actually took. If you run this kind of service on your own hardware, our self-hosting infrastructure page covers how to do it with less exposure.

See how we approach security hardening, or request a quote to have your exposed services reviewed.

Get security alerts like this one by email, with the free checklist, at our security alerts page.

Sources: Plex security advisory; QNAP Plex2Shell FAQ; Researcher write-up; CISA Known Exploited Vulnerabilities data; BleepingComputer on QNAP's notice.