Plex2Shell: the Plex Media Server exploit chain went from PoC to crypto mining in 24 hours

On October 16, 2026, researcher Zach Main published Plex2Shell, a chain of four flaws — CVE-2026-96652, 96654, 96655 and 96656 — enabling unauthenticated remote code execution on Plex Media Server. By October 17, attackers were deploying an XMRig miner and a residential proxy on exposed servers: update to 1.43.3.10861 and take Plex off the public internet.