Plex2Shell: CISA Orders Patch as Hackers Hit Plex Media Servers

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four Plex Media Server flaws, together called Plex2Shell, to its catalogue of vulnerabilities known to be exploited, after attackers used them to break into servers and install cryptocurrency miners. CISA told US federal agencies to patch or apply mitigations by 23 October, BleepingComputer reported on Wednesday, 21 October. Plex Media Server is widely used software that lets people stream their own films, shows and music from a home computer or storage drive.

Four Medium Bugs Chained Into a Takeover

The four flaws are CVE-2026-96652 and CVE-2026-96655, both server-side request forgery bugs rated 5.3; CVE-2026-96654 (6.9), an encoding problem in a web page; and CVE-2026-96656 (8.6), which lets outside input control a file name or path. Researcher Zach Main, who reported them, says an attacker can chain the four to run code on a server without logging in.

BleepingComputer said reports of attacks began on 17 October, three days after Main published technical details and then a working proof-of-concept exploit. The early attacks installed a cryptocurrency miner, and researcher boredhackerblog later reported proxy malware as well, according to The Hacker News.

The Fix Has Been Available Since August

Plex fixed the flaws in Plex Media Server 1.43.3.10861, released in early August, so only servers that have not been updated for more than two months are exposed. Users can check the version in the Plex web app’s settings and install the update from there. Servers that can be reached from the internet are the ones open to the remote attack chain.

A 23 October Deadline for US Agencies

CISA added six flaws to its list in the same batch. Agencies must fix CVE-2026-96656, CVE-2026-96654 and CVE-2026-106931, a command injection bug in EG Secure Solutions’ SiteGuard Server Edition, by 23 October. The rest, including a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) that has been abused in ClickFix attacks, are due by 3 November. The order binds US federal agencies only, but CISA’s list is widely used by companies elsewhere to decide what to patch first.

Also this week: two critical PHP flaws drew exploitation attempts before their fix. More reports are in Daily Updates.

Based on reporting by BleepingComputer and The Hacker News.

Image: BleepingComputer.