Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Attackers started abusing the Plex2Shell bug chain just one day after a researcher published technical details and working exploit code on October 16. The four flaws — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — can be chained to achieve unauthenticated remote code execution on exposed Plex Media Server instances, running with the same privileges as the Plex service itself.

Plex had already been notified back on July 27, confirmed and rewarded the report on August 4, and shipped patches by September 1, urging admins to upgrade immediately. Despite this, a separate researcher running an internet-facing Plex honeypot on a vulnerable build recorded genuine in-the-wild exploitation starting October 17, using what appears to be the public PoC with possible modifications.

Once compromised, the honeypot was infected with an XMRig-based cryptominer, and later the same day a second tool called myawesomeproxy was deployed, which turns the host into a traffic-relaying proxy — potentially valuable to attackers since many Plex servers run on residential IPs that could aid access to corporate VPNs or email accounts. Server owners who have not yet applied Plex's September fix are advised to update without delay.