Skip to contentistheinternetok
All incidents

Security flaw·Major

Plex2Shell: hackers hijack unpatched Plex servers

Fix availableAttackers already use itAffects everyone
Plex Media Server

What it changes for you

Home Plex servers that are not updated can be taken over.

Attackers are chaining four flaws in Plex Media Server, the home movie server many people run, to take over machines and install crypto miners. If you run a Plex server, update it.

Started Oct 16, 2026Updated Oct 21, 2026

Post on X

What should I do?

You
If you run a Plex Media Server, update it to version 1.43.3.10861 or later. Watching Plex as a viewer needs no action.
If you run a website or an app
Update Plex Media Server to 1.43.3.10861 or later and check internet-facing servers for unknown processes such as crypto miners or proxy software.

What is affected

CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656

Timeline

  1. Fix available · Oct 20, 2026

    CISA adds the four Plex Media Server flaws to its Known Exploited Vulnerabilities catalog.

    CISA

  2. Fix available · Oct 17, 2026

    First exploitation reports: attackers drop a crypto miner on exposed servers.

    BleepingComputer

  3. Fix available · Oct 16, 2026

    Technical details of the four-flaw chain are published; builds from 1.43.3.10861 (released August 4) are not affected.

    BleepingComputer

Sources