CVE-2026-96652(plex / media_server)

🚨 PoC RELEASED: "Plex2Shell", a 4-CVE chain in Plex Media Server. The cause: an SSRF in the companion player endpoint lets the server call itself on loopback. That reaches internal plugin functions, leaks the owner admin token, and ends with a library written to the Codecs directory that runs when the transcoder starts. CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 Affected: Plex Media Server before 1.43.3.10861 What is confirmed: • Public repo and write-up published Oct 16 • One researcher saw the published code hit a honeypot on Oct 17 and a cryptominer dropped • NVD scores each CVE 4.3 to 7.2 (CVSS 3.1). The write-up claims unauthenticated RCE for the full chain • Not in CISA KEV as of Oct 19 What is not confirmed: any mass campaign. The documented exploitation is that one honeypot. Do now: update to 1.43.3.10861+, keep port 32400 off the internet, check for unexpected child processes of Plex and unknown files in the Codecs folder. Full breakdown: the four CVEs, NVD scores, what is confirmed vs unknown, indicators and the step-by-step checklist. https://www.threatwire.tech/threats/plex2shell-chain-cve-2026-96652-96654-96655-96656-has-public-poc #Plex #PlexMediaServer #CVE #InfoSec #RCE

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 https://t.co/EhXwbArhSW

...without further ado.... > Weaponized Plex2Shell chain (CVE-2026-96652/54/55/56) in Python + C. Hardened re-impl of the original + encrypted two-stage in-memory C2 beacon. Built to defeat public YARA/detection rules. Lab only. > https://jackalsyn.com/posts/plex2shell-wz.html #CyberSecurity #infosec https://t.co/Hh6j4yELJZ

Plex Media ServerのPlex4Shell脆弱性が悪用された。ハニーポット観測。4件の脆弱性(CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)を連鎖させることで無認証で遠隔コード実行可能。 https://securityonline.info/plex2shell-plex-media-server-exploited/

🛡️ CYBER BULLETIN | 2026/10/19 🚨 1) Plex2Shell: four Plex Media Server bugs (CVE-2026-96652, -96654, -96655, -96656) chain into a takeover with no login. The exploit went public Oct 16 and a researcher's honeypot was running a Monero miner and a proxy the next morning. It's fixed in 1.43.3.10861 and later. Update, turn off Remote Access if you don't use it and check the Codecs folder for files you don't recognize. https://ctxsec.com/items/plex-media-server-plex2shell-exploited-2026-10 2) SiteGuard Server Edition, a Japanese WAF that claims to protect 1.5M+ websites, has a command injection bug (CVE-2026-106931) that's already being exploited to run commands as root or SYSTEM. It sits in the statistics feature, which is on by default. Update to 8.00 Update 5 (7.00 Update 6 on FreeBSD), but download the diagnostic info first, because the fix can wipe the attack traces. https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/ 3) Someone drained 1,404 Qubic wallets of about $1.3M in 104 minutes. The flaw was in seed generation. Seeds made in iPhone and iPad browsers, Safari on Mac or the old iOS app relied on Math.random(). Validators halted the chain with 87% of the funds still on it, and MEXC froze the rest. Wallet 4.26.4 switches to crypto.getRandomValues(). If your seed came from any of those, treat it as burned. https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/ 4) The npm package imgdecode (MALFEX campaign) loads a Windows DLL that pulls encrypted shellcode from GitHub and injects it into dllhost.exe. The end payload goes after browser data, wallet seeds and .env files. It has 979 downloads and was still live on npm this morning. Check your lockfiles for imgdecode, imgbundle, cdn-img-fetch and runhelper. https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html How many of the boxes you self-host, like that Plex server in the closet, actually update themselves? #CyberSecurity #InfoSec