Plex2Shell: 4-CVE Exploit Chain Hits 49,000 Unpatched Plex Servers -- Patch Before November 3

The Plex2Shell chain requires four vulnerabilities in sequence to achieve unauthenticated code execution. Each flaw on its own is limited in impact, but chained together they collapse the security boundary entirely.

Step 1 (CVE-2026-96652): An attacker sends an unauthenticated GET request to the Plex /player/timeline endpoint with a manipulated containerKey parameter pointing to an attacker-controlled URL. Plex fetches the specified URL server-side and reflects the response, acting as an unintentional proxy. By directing this SSRF to Plex's own internal API, the attacker extracts the Plex admin authentication token from the XML response. No credentials are required at this stage.

Step 2 (CVE-2026-96654): Using the stolen admin token, the attacker issues a second SSRF through the /video/:/transcode/universal endpoint. This request instructs Plex to fetch a malicious ELF shared object (.so file) from an attacker-controlled host (observed: 217.60.194.116) and stage it locally.

Step 3 (CVE-2026-96655): A file-write vulnerability allows the fetched payload to be written to the Plex data or plugin directory without further authentication beyond the token already stolen in Step 1.

Step 4 (CVE-2026-96656): Plex loads the newly written shared object as a library or plugin, executing its contents with the privileges of the Plex service process. The attacker now has arbitrary code execution.

The full chain from initial SSRF to code execution can be scripted to run in seconds. Because the only external requirement is network reachability on port 32400, any Plex server with Remote Access enabled is a viable target. Similar multi-CVE chains have appeared before -- the PHP2Shell chain (CVE-2026-109618/109619) followed a comparable pattern of authentication bypass leading to execution.

Approximately 49,000 Plex Media Server installations remained unpatched as of mid-October 2026, according to internet scan data reviewed after the exploitation wave began. Every one of these servers represents an active target.

Plex Media Server is not only a home media application. It is widely deployed in small and medium businesses for internal video sharing, in educational institutions, in healthcare for radiology DICOM viewing add-ons, and in media production environments. Many deployments have port 32400 permanently forwarded to the internet so users can stream content while traveling.

The risk profile is amplified by three factors. First, the fix shipped August 3 with no security advisory, so administrators who did not read the release notes did not know to prioritize the update. Second, Plex's "behind-the-firewall" reputation led many users to underestimate the exposure of servers with Remote Access enabled. Third, the September 1 announcement used understated language, and many community forum posts suggest users treated the update as optional.

The CISA KEV listing confirms that opportunistic attackers are scanning for unpatched instances at scale. The AISURU botnet infrastructure detected in post-exploitation traffic suggests a well-resourced operation with automated tooling, not manual opportunistic attacks.

If your organization runs Plex Media Server and has not audited the installed version since August, assume you are vulnerable until you verify otherwise.

All confirmed Plex2Shell attacks deploy two payloads. The primary payload is mylovelyminer, an XMRig-based Monero cryptocurrency miner. The miner is downloaded as a shell script from 217.60.194.116 using curl or wget, saved as a binary named mylovelyminer or x12345, then executed and persisted via a cron job or systemd unit. It connects to a mining pool relay at ota.proxystream.st.

The secondary payload is myawesomeproxy, a proxyware backdoor that enrolls the compromised server into the AISURU botnet. AISURU is a proxy network that rents out bandwidth from compromised hosts. Operators can repurpose enrolled hosts for credential-stuffing attacks, residential proxy services, or staging further intrusions. Infrastructure analysis shows the AISURU C2 relay domain proxystream.st used in this campaign.

The attacker IPs observed conducting the initial SSRF requests include 91.92.40.202, 176.65.139.228, and 45.194.92.222. The miner download server is 217.60.194.116. These IPs should be blocked at the perimeter immediately.

Unlike more targeted campaigns, Plex2Shell exploitation appears automated and opportunistic. The AISURU overlap suggests the campaign is operated or contracted by a threat actor focused on monetizing compute resources rather than data theft, which aligns with the LiteLLM PyPI supply chain attack pattern of infrastructure exploitation for computational gain.

These rules target the initial SSRF exploitation of the /player/timeline endpoint and the post-exploitation process artifacts (CVE-2026-96652 through CVE-2026-96656). Both carry experimental status; validate against your Plex server log format before enabling automatic blocking.

The patch for all four Plex2Shell CVEs shipped in August 2026 and has been available for nearly three months. The only reason to delay is an untested update in a complex media environment. Given active exploitation, that delay is no longer acceptable.

Plex Media Server does not appear on most enterprise vulnerability management watchlists. That gap is exactly why Plex2Shell is effective at scale.

Media server software is routinely deployed outside the standard change management and patch cadence that governs enterprise servers. IT departments often treat Plex as an end-user application, and users treat it as personal infrastructure. Neither group consistently applies security patches on a schedule that responds to CISA KEV listings.

The AISURU botnet connection raises a second concern beyond crypto mining. Proxyware infrastructure is routinely used to launder IP addresses for credential-stuffing attacks against corporate identity providers. A compromised Plex server enrolled in AISURU gives the operator a residential-looking IP that bypasses many rate-limiting and geolocation controls. Organizations with Plex instances that predate the August 3 patch may already be providing cover for attacks against their own Okta, Entra ID, or other SaaS identity systems.

The CISA KEV November 3 deadline covers federal agencies under BOD 22-01, but the Ivanti Connect Secure zero-day (CVE-2026-104935) showed that CISA KEV-listed flaws spread from government networks to commercial organizations rapidly. The appropriate response is treating the November 3 federal deadline as your organizational deadline too.

The patch is free, available now, and has been available since August. The only remaining question is whether your asset inventory is complete enough to find every Plex instance before attackers do.