Plex2Shell: Plex Media Server CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 exploited in the wild — which version fixes it?

Four chained flaws in Plex Media Server (nicknamed Plex2Shell) allow unauthenticated remote code execution on servers reachable from the internet. Full details and proof-of-concept code went public on 2026-10-16; exploitation started 2026-10-17, and CISA added the four CVEs to its Known Exploited Vulnerabilities catalog on 2026-10-21. Reported payloads include cryptocurrency miners (XMRig) and proxy processes. Am I affected: any Plex Media Server older than 1.43.3.10861, highest risk if port 32400 is reachable from the internet (directly or via router port forwarding / UPnP). Check the version in Plex Web: Settings > General, or the server's About page. Fix: 1. Update Plex Media Server to 1.43.3.10861 or later (on NAS or Docker, update the package/container image, not just restart it). The fixed Plex Desktop release is 1.115.0.426. 2. Stop exposing port 32400 directly to the internet where you can; use Plex's relay/remote access settings or a VPN instead, and turn off UPnP on the router if you don't need it. After updating, look for signs the server was already hit: unknown processes with high CPU (miners), unexpected Docker containers, new cron jobs or users, and outbound connections you don't recognize. If you find any, rebuild the host and change passwords and tokens that were stored on it. Sources: https://securityonline.info/plex2shell-plex-media-server-exploited/ ; https://cordcuttersnews.com/plex-media-server-owners-urged-to-update-immediately-after-in-the-wild-exploitation-of-older-installations-turns-your-computer-into-a-zombie/ ; https://www.sentinelone.com/vulnerability-database/cve-2026-96652/