CISA warns of active Plex2Shell attacks on Plex Media Server

CISA warned on October 21 that real-world attacks chaining four Plex Media Server vulnerabilities, known as Plex2Shell, are spreading, and urged users and federal agencies to apply emergency security measures, according to dailysecu.com.

The attack chain lets an attacker abuse internal server functions to steal administrator authentication tokens and run malware remotely without logging in. The four flaws involved are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and a security researcher rated the overall attack risk 9.8 out of 10.

Plex Media Server versions before 1.43.3.10861 are affected; later versions fix the vulnerabilities. CISA ordered US federal agencies to complete security updates or mitigations by October 23.

On July 27, security researcher Zach Main reported the issues to Plex. Technical analysis and proof-of-concept exploit code were published on October 16, after which real attack attempts spread, and Plex confirmed that widespread attacks are targeting unpatched servers exposed to the internet.

Some compromised servers were found running cryptocurrency mining programs or relaying attackers' other traffic.