Plex Vulnerability 2026: Update Plex Media Server Now to Stop Plex2Shell

Last updated: October 19, 2026. By Veer. Facts checked against Plex’s security notice (September 1), Plex’s release-notes thread, CISA’s advisory VA-26-266-01 (September 23), the researcher’s Plex2Shell write-up (October 16), BoredHackerBlog’s honeypot report (October 17–18) and CISA’s KEV catalog (version 2026.10.16). We haven’t run the exploit or the checks below ourselves; the steps come from Plex’s and the researchers’ own documentation.

If you run Plex at home on a PC, a NAS, a Raspberry Pi or a Docker box, this is a five-minute job worth doing today. Below is what the bug does, how to tell if your server is affected, how to update on every common platform, and what to look for if you think someone already got in.

What is the Plex vulnerability (Plex2Shell)?

Plex2Shell is a chain of four Plex Media Server bugs that, used together, let an attacker with no account steal the server owner’s admin token and then run their own code on the computer hosting Plex. CISA’s advisory sums it up: “In the worst case, a remote attacker could steal a legitimate user’s account credentials and eventually write arbitrary files or execute code.”

The researcher who found it, who posts as ZM (@zm_0x), explains the chain in his October 16 write-up. In plain English, it works in five steps:

1. A fake token gets in the door. The /player/timeline endpoint only checks that an X-Plex-Token header exists, not that it’s valid, so “junk” works.
2. The server is tricked into calling itself. A full URL hidden in the protocol parameter makes Plex send a request to its own 127.0.0.1 address, which it trusts.
3. A loopback-only plugin API is abused. From that trusted position, a broken check in searchOne lets the attacker call any plugin function.
4. The owner’s admin token is leaked. Plex attaches the owner token to any outbound request whose URL starts with http://127.0.0.1. A hostname like 127.0.0.1.<attacker-ip>.sslip.io passes that check but resolves to the attacker’s server.
5. The transcoder writes and loads a malicious file. With the owner token, the attacker sets the TranscoderH264Options preference to x264’s dump-yuv debug option, which writes an attacker-built library into Plex’s Codecs folder. The next transcode loads it, and the code runs as the Plex user.

Each bug on its own scores only Medium or High: CISA lists CVSS 3.1 scores of 4.3, 6.5, 4.3 and 7.2. Chained, they need no login at all, which is why the researcher’s proof-of-concept README rates the full chain 9.8 Critical.

The CVEs at a glance

CVE-2026-96651 isn’t part of the Plex2Shell chain, but CISA’s advisory lists it alongside the others and the same update fixes it.

Is the Plex vulnerability being exploited?

Yes, at least once in the wild: a security researcher’s honeypot running a vulnerable Plex Media Server was compromised on the morning of October 17, 2026, the day after the exploit code went public. The researcher behind BoredHackerBlog says the attack used the published exploit’s exact request pattern, including a 127.0.0.1.45-194-92-222.sslip.io callback, and dropped an XMRig Monero miner.

In an update later on October 17, the same researcher reported a second payload called “myawesomeproxy”, a residential-proxy tool that prints: “Running this software on any of your devices makes you agree to the potential external use of your internet traffic.” In other words, strangers can route their traffic through your home internet connection. He had warned in the same post that home Plex servers sit on residential IP addresses that attackers “would love to have” for reaching corporate VPNs and email.

Keep the scale in perspective. This is one honeypot, not a measured campaign. As of today, Plex hasn’t commented publicly on the attacks, no vendor or scanning firm has published a count of compromised servers, and none of the four CVEs is on CISA’s Known Exploited Vulnerabilities (KEV) list (catalog version 2026.10.16). That can change quickly now that working code is on GitHub.

How many Plex servers are still unpatched?

The last public count is from September 9, 2026, when the Shadowserver Foundation said it had found “over 36K instances” of Plex Media Server still on 1.43.2 or earlier, with the US the most affected at about 16,000. Shadowserver posted that figure on X after it started scanning daily on September 4. The count is now more than a month old, predates the public exploit, and wouldn’t include servers stuck on the still-vulnerable 1.43.3.10828.

This isn’t hypothetical history either. An older Plex bug, CVE-2020-5741, has been on CISA’s KEV list since March 10, 2023, after LastPass said attackers used an unpatched Plex on an engineer’s home computer as a stepping stone in its 2022 breach, as BleepingComputer reported.

Which Plex versions are affected?

Every Plex Media Server build before 1.43.3.10861 is vulnerable, according to CISA’s advisory, and that includes the July 2026 build 1.43.3.10828. So “I’m on 1.43.3” isn’t enough; check the full number. The safe builds are 1.43.3.10861 and anything newer.

Dates come from Plex’s official release-notes thread. The exploit’s GitHub README says “< 1.43.3.10828”, which conflicts with CISA’s “before 1.43.3.10861”; go by CISA and Plex and treat 1.43.3.10828 as vulnerable.

You don’t need a paid Plex Pass to get the fix. Plex marked 1.43.3.10861 and 1.43.4.10903 as “now available to everyone.”

Do Plex apps on my TV, phone or Roku need updating?

No, Plex2Shell is a server bug. The Plex app on your TV, phone, game console or streaming stick is a client that plays media; the server is the computer, NAS or container that stores your library and listens on port 32400. Keep your apps updated as normal, but the urgent fix is on the server. (Plex’s September 1 notice also told users of the Plex Desktop app to update to 1.115.0 or newer for separate fixes.)

Should you update Plex Media Server now?

Yes. If your server is older than 1.43.3.10861, update today, because a working, public exploit now exists and the fix has been out since August. The only realistic reasons a home server is still vulnerable are a disabled auto-update, a NAS app store that lagged behind, or a Docker container pinned to an old image.

Plex itself warned on September 1 that “If you’re running Plex Media Server on a NAS device, the updated version may not be available in their package manager yet,” and its release notes add that “Not all app stores (e.g. QNAP, etc.) will have the update immediately.” The honeypot in this story was a Docker container: the hunting notes compiled by ctxsec say it ran linuxserver/plex:1.42.2.

How to check your Plex Media Server version

Open Plex Web, go to Settings, choose your server, and open General: the version number is shown at the top. Anything below 1.43.3.10861 needs updating.

1. Go to app.plex.tv and sign in as the server owner.
2. Click the Settings (wrench) icon.
3. Under your server’s name, open General and read the Version line.
4. Alternatively, on your home network, open http://<server-ip>:32400/identity in a browser and look for the version= value.

How to update Plex Media Server (every platform)

On Windows and macOS, update from Settings → General in Plex Web or download the latest installer from Plex’s downloads page; on Linux, NAS and Docker the steps differ, as below. These follow Plex’s own September 1 instructions and the official Docker image docs.

For a Docker Compose setup with a fixed image tag, the usual pattern is docker compose pull followed by docker compose up -d, then re-check the version. The plexinc/pms-docker README says the public and beta images “will perform an update check and fetch the latest version” each time they start, while linuxserver’s README notes that with no VERSION value “no updates will take place” inside the container.

How to lock down Plex after updating

After updating, turn off Remote Access if you only watch at home, remove any router port forward for port 32400, and switch on two-factor authentication for your Plex account. The attack needs network access to the server, so closing the internet-facing door shrinks your exposure to future bugs too.

• Remote Access: In Plex Web, go to Settings → Server → Remote Access. Plex’s support article explains that the server tries to map a port automatically “using UPnP or NAT-PMP” unless Remote Access is disabled. If you don’t stream away from home, disable it, then delete any manual port forward to 32400 on your router.
• If you do stream remotely: keep Remote Access on only on a patched server. Updating still matters even with Remote Access off, because any compromised device on your home Wi-Fi can reach the server.
• Two-factor authentication: On your plex.tv Account page, open Two-Factor Authentication and click Enable. Plex’s 2FA guide notes you need a Plex password and a verified email first, so Google/Apple-only sign-ins must set a password. Plex’s 2FA uses an authenticator app; for why that’s stronger than text-message codes, see our SMS vs authenticator app vs passkeys guide.
• Account hygiene: because the chain steals the owner’s admin token, it’s sensible to change your Plex password and remove devices you don’t recognize from your account’s authorized devices list, then sign your own apps back in.

How to tell if your Plex server was hacked

The clearest warning signs are a CPU pinned near 100% when nobody is streaming, unexplained upload traffic, unexpected files in Plex’s Codecs folder, and a dump-yuv value in Plex’s transcoder settings. Those match what the honeypot saw (a Monero miner and a proxy) and the indicators the researchers published.

The researcher behind Plex2Shell has also published a read-only hunt script and YARA rules in the plex2shell repository’s detection folder. Read any script before running it, and only run it on machines you own.

If you find signs of compromise: disconnect the machine from the internet, reinstall Plex Media Server at the current version (for Docker, delete the container and recreate it from a fresh image), and remove unexpected files from the Codecs folder, which Plex re-downloads. The attacker’s code ran with the Plex user’s permissions, so change passwords for anything that account could read, such as network shares. If the server is also your everyday PC, a full operating-system reinstall is the safest choice.

Plex2Shell timeline

While you’re patching, finish this month’s other updates too: the October 2026 Patch Tuesday fixes for the Windows PC that may be running your Plex server, and, if that PC is on Windows 10, check its security-update cutoff in our Windows end of support calendar.

FAQ

What is the Plex vulnerability in October 2026?

It’s Plex2Shell, a chain of four Plex Media Server bugs (CVE-2026-96652, -96654, -96655 and -96656) that lets an attacker with no account take over servers older than 1.43.3.10861 and run code on them. Exploit code went public on October 16, 2026.

Which Plex version fixes Plex2Shell?

Plex Media Server 1.43.3.10861 and later fix it, according to CISA’s advisory. The current public build is 1.43.4.10903. Build 1.43.3.10828 is still vulnerable.

Is Plex2Shell being exploited in the wild?

Yes, in at least one confirmed case: a researcher’s honeypot was compromised on October 17, 2026 and used to run an XMRig crypto miner and a residential-proxy tool. No wider count of hacked servers has been published.

Do I need Plex Pass to get the security fix?

No. Plex released 1.43.3.10861 and 1.43.4.10903 to everyone, not just Plex Pass subscribers.

Should I turn off Plex Remote Access?

If you only watch at home, yes: disable it under Settings, Server, Remote Access and remove any port forward for 32400. If you stream away from home, update first and keep Remote Access on only on a patched server.

Was Plex itself hacked?

None of the sources report a breach of Plex’s own systems in this case. Plex2Shell is a flaw in the server software that people run on their own computers, NAS boxes and containers.

Sources

• Plex: Important Security Update for Plex Media Server v1.43.2 and earlier (September 1, 2026)
• Plex: Plex Media Server release-notes thread (1.43.3.10828 on July 14; 1.43.3.10861 on August 4; 1.43.4.10903 on September 10; 1.43.5.11029 beta on October 6)
• CISA: Vulnerability Advisory VA-26-266-01, Plex Media Server (September 23, 2026)
• GitHub Advisory Database: CVE-2026-96652
• ZM: Plex2Shell, Unauthenticated RCE in Plex Media Server (October 16, 2026) and proof-of-concept repository
• BoredHackerBlog: Plex vulnerabilities being exploited in the wild to drop a cryptominer (October 17, updated October 18) and pcaps and samples
• Shadowserver on X: 36K unpatched Plex instances (September 9, 2026)
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.16, checked October 19)
• ctxsec: Plex2Shell exploitation alert and hunting notes (October 18)
• Plex Support: Remote Access and Two-Factor Authentication
• plexinc/pms-docker README and linuxserver/docker-plex README
• BleepingComputer: CISA warns of actively exploited Plex bug after LastPass breach (2023)