Dark Web Intelligence (@DailyDarkWeb) on X

What it is

Plex2Shell is the name a researcher gave to a chain of four Plex Media Server flaws that can end in remote code execution on servers older than 1.43.3.10861. The researcher published a write-up and proof-of-concept on 16 October 2026 and rates the combined chain as unauthenticated RCE. The post comes from the @DailyDarkWeb account, which is summarising the research, not presenting it first-hand.

How it works

The post gives one line per flaw and does not describe how they are linked or in what order they are triggered:

• CVE-2026-96652: server-side request forgery (SSRF).
• CVE-2026-96654: URL injection into plugin calls.
• CVE-2026-96655: SSRF via the transcode path.
• CVE-2026-96656: arbitrary file write that runs on load.

The Codecs folder detection hint suggests the file write lands there, but the post does not say so.

Preconditions / Affected

Any Plex Media Server older than 1.43.3.10861 is affected. The post says Plex listens on port 32400 and is often exposed directly to the internet. CISA advisory VA-26-266-01 (23 September 2026) scores the individual CVEs from 4.3 to 7.2. That is lower than the researcher's rating of the chain, and the CVEs are not in CISA KEV.

What to do

• Update to 1.43.3.10861 or later. Plex fixed the issues in that version and urged all server owners to update on 1 September 2026.
• NAS and Docker users must pull the new package or image manually.
• Do not expose port 32400 directly to the internet.
• On servers that ran older versions, look for unknown Plex child processes, new files in the Codecs folder, and unexpected CPU load.

The post gives no commands or detection queries.

Caveats

Community reports of compromised servers running miners and proxies have not been confirmed by Plex or CISA. The "unauthenticated RCE" rating is the researcher's, and the CISA scores are for the CVEs taken individually. The post does not cover exploit prerequisites or whether a specific configuration blocks the chain, and it links the Plex forum announcement and the CISA CSAF file as sources.