🚨 PoC RELEASED: "Plex2Shell", a 4-CVE chain in Plex Media Server. The cause: an SSRF in the companion player endpoint lets the server call itself on loopback. That reaches internal plugin functions, leaks the owner admin token, and ends with a library written to the Codecs directory that runs when the transcoder starts. CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 Affected: Plex Media Server before 1.43.3.10861 What is confirmed: • Public repo and write-up published Oct 16 • One researcher saw the published code hit a honeypot on Oct 17 and a cryptominer dropped • NVD scores each CVE 4.3 to 7.2 (CVSS 3.1). The write-up claims unauthenticated RCE for the full chain • Not in CISA KEV as of Oct 19 What is not confirmed: any mass campaign. The documented exploitation is that one honeypot. Do now: update to 1.43.3.10861+, keep port 32400 off the internet, check for unexpected child processes of Plex and unknown files in the Codecs folder. Full breakdown: the four CVEs, NVD scores, what is confirmed vs unknown, indicators and the step-by-step checklist. https://www.threatwire.tech/threats/plex2shell-chain-cve-2026-96652-96654-96655-96656-has-public-poc #Plex #PlexMediaServer #CVE #InfoSec #RCE
