If you run Plex Media Server, open Plex Web, go to Settings, then General, and read the version. Anything older than 1.43.3.10861 needs updating today. Plex says these flaws are being actively and widely exploited.
Update now
Plex announced Plex Media Server 1.43.3 as a security fix on Sept. 1, 2026. Its Oct. 19 update says builds 1.43.3.10861 and later are not affected.
- Windows and macOS: turn on automatic updates and confirm you are on 1.43.3.10861 or newer, or download the latest build from Plex's Downloads page.
- Linux: download the .deb or .rpm from the Downloads page and install it.
- NAS: install the package manually. Plex warns the NAS package manager may lag behind.
- Docker: follow the pms-docker repository on GitHub.
- NVIDIA Shield: install pending updates in the Play Store.
Who is at risk
Plex says the attacks target internet-facing servers that have not updated. Its wording: if your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.
A server only used inside your home network is a smaller target. Update it anyway.
What the attack does
A public proof of concept appeared on Oct. 16, Plex says, and widespread attacks followed. Chained together, the four flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.
Plex says compromised servers have been used for cryptocurrency miners and for proxy software that routes other people's traffic through the victim's connection.
Signs your server was hit
Plex lists these signs:
- Processes started by Plex Media Server that you do not recognize, with names like myawesomeproxy, mylovelyminer or x12345.
- Unfamiliar .so or .dll files in the Codecs folder.
- Outbound connections to proxystream.st.
- Sustained high CPU use while nothing is playing.
If you find any of them
Plex's advice applies if you find a sign or cannot rule out compromise.
- Rebuild from a clean install instead of reusing the old Plex data directory. At minimum, empty the Codecs folder and check Preferences.xml for transcoder options you did not set.
- Sign out of all devices and change your Plex password.
- Treat anything the Plex service account could reach, such as mounted shares and stored credentials, as potentially exposed.
If you do not need remote access, turn it off under Settings, then Remote Access. Avoid forwarding port 32400 unless you need it.
The four flaws
The group has a name, Plex2Shell, per TechCrunch. Plex lists the four CVEs in its thread:
| CVE | What it is |
|---|---|
| CVE-2026-96652 | Unauthenticated server-side request forgery in the player timeline endpoint |
| CVE-2026-96654 | Access to internal agent functions over the loopback interface |
| CVE-2026-96655 | Disclosure of the server owner's admin token |
| CVE-2026-96656 | Arbitrary file write to the Codecs directory through transcoder preferences |
CISA listing
CISA's Known Exploited Vulnerabilities catalog added all four flaws on Oct. 20. Details are on NVD for CVE-2026-96652 and CVE-2026-96654.
CISA's due dates for US federal agencies are Oct. 23 for CVE-2026-96654 and CVE-2026-96656, and Nov. 3 for CVE-2026-96652 and CVE-2026-96655. Its required action is to apply the vendor's mitigations, or stop using the product if none exist. Ransomware use is listed as unknown.
Our call
The patch has been out for seven weeks, so this is a patching failure, not a surprise. But a home media server is easy to forget, and many sit on a NAS whose app store lags. If yours is reachable from the internet and not on 1.43.3.10861, update first and inspect second.
We would also close the remote-access door unless you stream away from home. For related reading on securing home devices, see how to lock down a home security camera and UpdraftPlus users: update and check for rogue admins.
