Plex2Shell: Four Medium Bugs and a Root Shell

Hi, I was deep in a government pentest week when Plex2Shell dropped into my feeds, and it stopped me mid-coffee. Not because it is a CVSS 10. Quite the opposite: the four bugs in this chain score 5.3, 6.9, 5.3 and 8.6. Scanned alone they are report filler. Chained, a stranger runs binaries on your media server without a single credential.

Sources: Plex | The Hacker News report | PeakCyber breakdown | PoC writeup (boredhackerblog)

The chain

Zach Main reported the bugs to Plex on 27 July 2026. Plex shipped the fix in 1.43.3.10861 on 3 August. The PoC went public 16 October. Mass exploitation started the next day. Two months between patch and pwn, zero days involved.

1. CVE-2026-96652  (5.3) Unauth SSRF
   /player/timeline -> "protocol" param, zero validation
   server POSTs to any destination
2. CVE-2026-96654  (6.9) URL neutralization bug
   searchOne endpoint -> call other plugins' functions
   -> steal the OWNER admin token
3. CVE-2026-96655  (5.3) Authenticated SSRF
   /video/:/transcode/universal -> fetch attacker "carrier video"
   carrying a malicious ELF
4. CVE-2026-96656  (8.6) Path control
   ELF .so written to attacker-chosen path in Codecs dir
   -> Plex loads codecs -> RCE

1. CVE-2026-96652  (5.3) Unauth SSRF
   /player/timeline -> "protocol" param, zero validation
   server POSTs to any destination
2. CVE-2026-96654  (6.9) URL neutralization bug
   searchOne endpoint -> call other plugins' functions
   -> steal the OWNER admin token
3. CVE-2026-96655  (5.3) Authenticated SSRF
   /video/:/transcode/universal -> fetch attacker "carrier video"
   carrying a malicious ELF
4. CVE-2026-96656  (8.6) Path control
   ELF .so written to attacker-chosen path in Codecs dir
   -> Plex loads codecs -> RCE

What the payloads do

Attackers are not after your media library. They conscript the box. mylovelyminer is an XMRig Monero miner phoning home to ota.proxystream[.]st. myawesomeproxy is a stealth Linux reverse proxy that routes other people traffic through your connection, and yes, it prints a disclaimer about exactly that when you run it. Bitsight had already flagged the same proxystream infrastructure with the AISURU proxyware botnet back in August.

Am I running a vulnerable Plex?

Five minutes of hunting on the server box:

# Version check on the server box
cat "/usr/lib/plexmediaserver/Plex Media Server/Version.xml"

# miner / proxy processes and CPU hogs
ps aux | egrep -i 'mylovelyminer|myawesomeproxy|xmr'
top -b -n1 | head -15

# surprise shared objects in the codecs dir
find / -path /proc -prune -o -name "*.so" -newermt 2026-10-01 -path "*Codecs*" -print 2>/dev/null

# outbound to known infra
ss -tnp | egrep -i 'proxystream|217\.60\.194\.116'

# Version check on the server box
cat "/usr/lib/plexmediaserver/Plex Media Server/Version.xml"

# miner / proxy processes and CPU hogs
ps aux | egrep -i 'mylovelyminer|myawesomeproxy|xmr'
top -b -n1 | head -15

# surprise shared objects in the codecs dir
find / -path /proc -prune -o -name "*.so" -newermt 2026-10-01 -path "*Codecs*" -print 2>/dev/null

# outbound to known infra
ss -tnp | egrep -i 'proxystream|217\.60\.194\.116'

If anything matches: patch first, then rotate the Plex account token and password, because step 2 of the chain steals the owner token, so every credential tied to that account is exposed. Treat the box as owned until you have ruled the artifacts out.

Why I care

This is the exact shape of finding I keep writing in Malaysian government reports. Media servers, wikis, dashboards, the office Git box, all “convenient” tools that never joined a patch program. Plex did its part, the fix shipped two months before the exploitation wave. Nobody here lost a zero-day fight, they lost a backlog fight.

One day between PoC publication and live scanning is the new rhythm. If you run anything internet-facing that is not on a patch schedule and a monitoring feed, assume someone has already looked at its changelog. Find your exposures, patch on the clock, and alert on sustained CPU plus new outbound connections. That one behavioral rule catches miners and proxyware alike, even when the payload names change next month.