CISA Splits Plex2Shell Into Oct. 23 and Nov. 3 Patch Deadlines
Security / news
CISA Splits Plex2Shell Into Oct. 23 and Nov. 3 Patch Deadlines
All four Plex Media Server flaws entered the Known Exploited Vulnerabilities catalog on Oct. 20, four days after the researcher who found them published the full chain.
CISA added all four Plex2Shell flaws in Plex Media Server to its Known Exploited Vulnerabilities catalog on Oct. 20, with a federal patch deadline of Oct. 23 for two of them and Nov. 3 for the other two. An unauthenticated remote attacker who can reach the server's port 32400 can chain the four to run code as the plex user, according to the researcher who found them.
The fix is Plex Media Server 1.43.3.10861 or later. BleepingComputer reported that the build shipped on Aug. 4, 74 days before the catalog entry.
The four CVEs and their two deadlines
CISA's catalog data gives the same Oct. 20 added date to every entry but not the same due date. The entry does not say why. It also lists ransomware use as unknown for all four.
| CVE | Flaw | CISA due date |
|---|---|---|
| CVE-2026-96652 | Unauthenticated SSRF in /player/timeline | Nov. 3 |
| CVE-2026-96654 | URL injection in searchOne | Oct. 23 |
| CVE-2026-96655 | Authenticated SSRF in the transcoder endpoint | Nov. 3 |
| CVE-2026-96656 | Arbitrary file write in transcoder settings | Oct. 23 |
SSRF means server-side request forgery, where an attacker makes the server send a request on their behalf. The two earlier deadlines sit on the injection flaw and the file write, the last two steps of the chain. Patching either of those breaks it, though the catalog does not make that argument.
How the chain works
Zach Main, a security researcher, published the chain on Oct. 16 and scored it 9.8 on CVSS v3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). BleepingComputer said the individual flaws rate from medium to high. None of the pages The Terminal fetched carries a score from Plex or from NVD, so 9.8 is the researcher's own number, and it assumes the port is reachable.
The first step abuses /player/timeline, which checks that an X-Plex-Token header is present but not that it is valid. In Main's words, "hasParam() checks existence, not validity." That lets the attacker make the server send a blind POST to its own loopback interface, where the /system/agents/* API asks for no token.
The plugin framework then attaches the owner's admin token to any outbound URL that starts with http://127.0.0.1. Because the test is a prefix match, a hostname that resolves to the attacker's address receives the token. With it, the attacker sets a transcoder option so decoded video frames are written into the Codecs directory, and the transcoder loads every .so file there at startup.
Timeline from report to catalog
Main's post and the BleepingComputer and Cord Cutters News write-ups give this order:
- July 27: Main reports the flaws to Plex's security team.
- Aug. 4: Plex acknowledges the report and pays a bounty, per Main.
- Sept. 23: the four CVE identifiers are assigned.
- Oct. 16: Main publishes the chain. Cord Cutters News dates the public proof of concept to the same day.
- Oct. 17: a researcher's honeypot running an older Plex build is exploited.
- Oct. 20: CISA lists all four.
BleepingComputer, citing the blog boredhackerblog.info, said the honeypot attack installed an XMRig-based cryptocurrency miner and a proxy app called myawesomeproxy. Cord Cutters News said exploitation had been confirmed on that single honeypot only. CISA's listing is the wider signal that attacks exist.
Main wrote that he found the chain with language models in a four-step loop of recon, hunt, verify and chain, with a second agent trying to disprove each finding. He described hours of iterative work with his own decisions on what to pursue.
What to do on an exposed server
Update to 1.43.3.10861 or newer. Cord Cutters News said Plex sent notices to owners of 1.43.2 and earlier around Sept. 1, and that September assessments, whose authors it did not name, counted more than 36,000 internet-facing servers still unpatched.
If Remote Access is not needed, turn it off and keep port 32400 off the open internet. Servers that were exposed before patching should be checked for child processes of the Plex binary, processes named myawesomeproxy, mylovelyminer or x12345, and unfamiliar shared objects in the Codecs directory. Cord Cutters News considered a reinstall from a clean base the most reliable recovery for a confirmed compromise.
The catalog has carried similar entries this month, among them AhsayCBS and FortiMail. The next date here is Nov. 3, when the second pair of deadlines falls due for federal agencies.
Sources
More in Security
- 01SiteGuard WAF Flaw CVE-2026-106931 Is Exploited, and Patching Can Erase the EvidenceA local-vector command injection scored 8.5 gives root or SYSTEM on the firewall host, and the vendor tells customers to download diagnostics before updating.
- 02SafePay Ransomware Hit 600 Victims, and the Advisory's Newest CVE Is From 2024The FBI, CISA and German and British police list five vulnerabilities in AA26-293A, none newer than 2024, alongside a credential-first playbook that needs no exploit at all.
- 03Gheist Used 850 Stolen GitHub Tokens to Print Secrets Into Workflow LogsWiz Research recovered more than 13,500 planted branches, and GitHub's July approval hold stopped every public-repository run but not private or Enterprise Server ones.
- 04Siemens Software Center Flaw CVE-2026-110936 Is Exploited Through a Signed Copy of Its Own AppAttackers never modified Siemens' executable: they shipped a valid, signed copy with their own files beside it, and CISA listed the bug on Oct. 20.