Source: Ars Technica
Internet-exposed Plex Media Server installations are being actively exploited using a chain of four vulnerabilities that security researchers have nicknamed Plex2Shell. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws were disclosed to Plex on 27 July 2026 and patched in Plex Media Server 1.43.3.10861 released on 3 August. When chained together, the bugs allow unauthenticated remote code execution on a vulnerable server, no valid login required.
The proof of concept went public on 16 October 2026, and exploitation attempts were recorded within roughly a day. According to reporting by Ars Technica, The Hacker News and SecurityWeek, compromised servers are receiving XMRig cryptocurrency mining malware and reverse-proxy software that turns the host into a relay for someone else’s traffic.
Patched is not the same as protected
The campaign is a textbook lesson in patch discipline. The fix has existed for more than two months, yet enough servers were still running outdated builds that attackers found it worth running an automated exploitation chain against them. The individual bugs score modestly, with none of the four above 7.2 on CVSS, which means vulnerability scanners that rank purely by severity likely never surfaced them as urgent. Chained together, they deliver full server takeover.
Self-hosted media servers, NAS devices and home-lab boxes may look harmless, but anything exposed to the internet is infrastructure, and it is being scanned by automated tooling around the clock. For businesses, the same principle applies to every internet-facing service: if patching is not automatic and verified, assume it did not happen.
If your team runs self-hosted or internet-facing services and you want help setting up automated patch pipelines, exposure review and detection that catches this class of attack, contact Excello Digital at https://excello.digital/contact/. We help European organisations turn patch management from a manual chore into a measurable, auditable process.