Plex2Shell: How to Update Plex and Check Your Server Is Safe

Last updated: 22 October 2026. This is a live security story; we will update this page if Plex or CISA publish more.

If you run Plex at home to stream films, music and family photos around the house, now is the time to check it. Attackers are using a chain of four Plex vulnerabilities, nicknamed Plex2Shell, to break into Plex servers that have not been updated, and Plex says the attacks are active and widespread.^[1] The good news is that the Plex update that fixes it has been out since August. This plain-English guide explains what Plex2Shell is, how to check your Plex version and update it on Windows, Mac, Linux and NAS boxes, what to do if you think your server was hacked, and how to wipe an old Plex machine properly when you retire it. Everything here is accurate as of 22 October 2026.

What is Plex Media Server, and why does this Plex vulnerability matter at home?

Plex Media Server is software you install on a computer, a NAS (a small network storage box) or a similar device. It organises your films, TV shows, music and photos and streams them to TVs, phones and tablets, at home or over the internet.^[5] It listens on network port 32400 and is often opened up to the internet so you can watch while you are away.^[6]

That convenience is the problem. A Plex server is usually a machine that is left switched on all the time, sits on your home network next to your other devices, and has access to large folders of personal files. A flaw that lets a stranger run commands on it is a flaw that lets them into your home network.

What is the Plex2Shell vulnerability?

Plex2Shell is not one bug but four, found by security researcher Zach Main and reported to Plex on 27 July 2026.^[6] Plex describes them like this:^[1]

• CVE-2026-96652: server-side request forgery in the player timeline feature, which can be triggered without logging in. In plain terms, an outsider can make your Plex server send a web request on their behalf, including to itself.
• CVE-2026-96654: access to internal agent (plug-in) functions over the loopback interface, the server's private line to itself.
• CVE-2026-96655: disclosure of the server owner's admin token, the digital master key to your server.
• CVE-2026-96656: an arbitrary file write to the Codecs folder through the transcoder settings, which lets someone with admin rights plant a file that Plex later loads and runs.

Think of it as a con in four moves: trick the server into talking to itself, use that trust to reach functions meant only for the server, get it to hand over the owner's master key, then use the key to slip a malicious file into a folder Plex trusts. Chained together, Plex says, the flaws let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.^[1] On their own, the four are rated medium to high in the CVE records, with CVE-2026-96656 the highest at 8.6 out of 10.^[7] The researcher scores the full chain as critical, 9.8.^[5]

Is Plex2Shell being exploited?

Yes. Here is what has happened so far, as confirmed by the primary sources:

• 4 August 2026: Plex Media Server 1.43.3.10861 was released to everyone.^[8]
• 1 September 2026: Plex posted a security notice asking all server owners to update, without giving details.^[1]
• 16 October 2026: the researcher published the full technical write-up.^[6] Plex says a public proof of concept was released the same day; some reports date the working exploit code a few days later.^[1][5]
• 17 October 2026: a security researcher running a deliberately vulnerable Plex server as bait saw it attacked and used to install a cryptocurrency miner, then proxy software.^[9]
• 19 October 2026: Plex published the CVE details and said the flaws are being "actively and widely exploited" against internet-facing servers that have not been updated.^[1]
• 20 October 2026: CISA, the US cyber security agency, added all four CVEs to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation.^[4]

So far, Plex says hacked servers have been used to run cryptocurrency miners and proxy software, which routes other people's internet traffic through your home connection.^[1] That alone can slow your network and put strangers' traffic on your broadband account. CISA set US federal agencies deadlines of 23 October and 3 November 2026 to deal with the four flaws.^[10] Those deadlines do not apply to home users, but they show how seriously it is being treated.

Am I affected by Plex2Shell? A quick checklist

If you answer yes to the first two questions, update today and then check for signs of compromise.

• Do you run Plex Media Server on a PC, Mac, Linux machine, NAS, Docker container or NVIDIA Shield?
• Is your version lower than 1.43.3.10861?^[2]
• Is Remote Access turned on, or have you forwarded port 32400 on your router? Plex says servers that are older than 1.43.3.10861 and reachable from the internet should be treated as possibly compromised.^[1]
• Has the server been running with automatic updates switched off, or on a NAS whose app store updates lag behind?
• Does the Plex machine also hold personal documents, photo backups or saved passwords?

If you only use Plex as a viewer (the app on your TV or phone) and someone else runs the server, the server owner is the one who needs to update.

How do I check my Plex version?

Open Plex Web (the Plex app in your browser), click the settings (spanner) icon, choose your server and open General. The installed Plex Media Server version is listed there, along with its update status.^[3] Plex's own advice is to make sure it reads 1.43.3.10861 or newer.^[1]

Read the whole number. Plex's notice talks about "1.43.3", but an earlier 1.43.3 build, 1.43.3.10828, was released in July, and the CVE records say every version before 1.43.3.10861 is affected.^[2] If the last part of your number is below 10861, you still need the update.

How do I update Plex Media Server?

1. Check your version. Open Plex Web, go to Settings, then General under your server, and read the version number.
2. Compare it with the fixed build. You need Plex Media Server 1.43.3.10861 or later. Check the full number, not just 1.43.3.
3. Install the update. Use Check for Updates on Windows or Mac, your package manager or Plex's download on Linux, the NAS app centre or a manual package on a NAS, or restart a public-tagged Docker container.
4. Confirm it worked. Reload Settings, General and check the version now reads 1.43.3.10861 or higher.
5. Look for signs of compromise. Check for unknown processes, unfamiliar .so or .dll files in the Codecs folder and high CPU use while nothing is playing.
6. Reduce exposure. Turn off Remote Access if you do not need it and avoid forwarding port 32400 directly.

Windows and Mac

In Plex Web, go to Settings, General and use Check for Updates, then install it. On Windows and macOS you can also set server updates to install automatically during scheduled maintenance.^[3] If the update does not appear, download the latest version from Plex's downloads page and install it over the existing one.^[1]

Linux

Linux servers are not updated from inside Plex. Plex says Linux installs must be updated manually or through repository updates.^[3] If you added Plex's repository, run your normal system update. Otherwise, download the right package for your distribution from Plex's downloads page and install it over the existing one, then restart the Plex service and check the version again.

NAS boxes (Synology, QNAP, WD, Netgear, TerraMaster and others)

This is where many servers get stuck on old versions. Plex warns that the update may not be in your NAS app store yet, but you can install it manually: download the package for your NAS from Plex's downloads page, log in to the NAS web interface, open the app centre or package centre, choose the manual install option and follow the wizard.^[1] Plex links to step-by-step guides for QNAP, TerraMaster, WD, Netgear and Synology from its security notice.

Docker

If you use Plex's official Docker image with the public or beta tag, the container checks for and installs the latest version each time it starts, so stopping and starting it with an internet connection updates Plex.^[11] If you pinned a specific version tag, change it to 1.43.3.10861 or later and recreate the container.

NVIDIA Shield

Open the Google Play store on the Shield and install any pending updates.^[1]

What should I do if I think my Plex server was hacked?

Updating closes the door, but it does not remove anyone who came in while it was open. Plex lists these signs of compromise:^[1]

• Processes started by Plex Media Server that you do not recognise, especially names such as myawesomeproxy, mylovelyminer or x12345.
• Unfamiliar .so or .dll files in the Plex Codecs folder.
• Outbound connections to proxystream.st, or the computer working hard (high CPU use, fans running) while nothing is playing.

If you find any of these, or you simply cannot rule it out, Plex advises:^[1]

1. Rebuild the server from a clean installation rather than reusing the old Plex data folder. At the very least, delete everything in the Codecs folder and check Preferences.xml for transcoder options you did not set.
2. Sign out of all devices from your Plex account settings and change your Plex password.
3. Treat anything the Plex service could reach as exposed, such as shared folders and credentials stored on the same machine.
4. Turn off Remote Access under Settings if you do not need it, and avoid forwarding port 32400 directly.^[12]

In practice, "anything Plex could reach" may include more than films. If the same computer stores saved browser passwords, email or banking logins, change those from a different, clean device. If the Plex machine is old and you were planning to replace it anyway, this may be the moment.

Why is a Plex server full of family photos personal data?

Because it is information about real, identifiable people. The UK's data protection regulator, the ICO, defines personal data as information that relates to an identified or identifiable individual, and that can be as simple as a face, a name or a location.^[13] A typical home Plex library holds years of family photos and videos, children's school events, holiday locations, and often scanned documents or backups sitting in the same shared folders.

Plex2Shell runs an attacker's code with the same access as Plex itself, and Plex tells owners to treat anything the service could reach as potentially exposed.^[1] So far the reported payloads are miners and proxies, but nobody should assume that an intruder who can run code on the box ignored the photos. If you also keep work files or client data on your media server, data protection duties can apply to you as well; our guide to UK GDPR and old devices for small businesses explains what that means in practice.

How do I wipe an old Plex PC or NAS drive before selling or recycling it?

Plex2Shell is a good reminder that media servers collect a lot of personal data and tend to be forgotten. When you retire one, deleting the library or reinstalling the operating system is not enough, because the data may still be recoverable from the drive. Do it in this order:

1. Back up and check. Copy the photos and documents you want to keep to a new drive or service, and open a few files to make sure the copy works.
2. Sign out. Sign out of Plex and any other accounts on the old machine.
3. Find every drive. A Plex PC may have several internal disks plus USB drives. A NAS usually has two or more drives working together, and each one holds some or all of your data, so every drive must be wiped.
4. Erase the whole of each drive with a proper data erasure tool, not a quick format, and check the result.
5. Then sell, donate or recycle. Keep a note of what you erased and when.

For most Windows PCs and Intel-based Macs that ran Plex, a bootable tool such as RedKey USB can erase the system disk and other connected disks in one operation, up to 16 per computer. For NAS drives, take them out and connect them to a compatible PC, then erase each one. RedKey Home shows the result on screen; RedKey Professional and Ultimate add PDF reports, which are useful if you want a record. RedKey does not support Apple silicon Macs or ARM-based Windows devices; on an Apple silicon Mac, use Apple's Erase All Content and Settings.^[14] Our guides on erasing external drives and selling an old laptop or PC cover the steps in more detail.

Plex2Shell FAQs

What is Plex2Shell?

Plex2Shell is the name a security researcher gave to a chain of four Plex Media Server vulnerabilities, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together, they let an attacker on the internet run code on an unpatched Plex server without a password.

Which Plex update fixes Plex2Shell?

Plex Media Server 1.43.3.10861 or later. Plex released it to everyone on 4 August 2026, and Plex says that version and later are not affected.

Is Plex 1.43.3 enough?

Not necessarily. Check the full build number. The CVE records say versions before 1.43.3.10861 are affected, and an earlier 1.43.3 build (1.43.3.10828) was released in July, so look for 10861 or higher at the end.

Do I need to update the Plex apps on my TV or phone?

Plex2Shell is in Plex Media Server, the software on the computer or NAS that holds your library, so that is what must be updated. Plex's September notice also asked Plex Desktop users to update to 1.115.0 for separate security fixes, so keeping every app up to date is sensible.

Is Plex2Shell the same as a Plex account data breach?

No. Plex2Shell is a flaw in the server software you run at home, not a leak of Plex's own account database. If you cannot rule out that your server was compromised, Plex still advises signing out of all devices and changing your Plex password.

Sources

1. Plex, Important Security Update for Plex Media Server v1.43.2 and earlier (1 September 2026, CVE update 19 October 2026)
2. NVD, CVE-2026-96652 (Plex Media Server before 1.43.3.10861)
3. Plex Support, General (server settings: version and updates)
4. CISA, CISA Adds Six Known Exploited Vulnerabilities to Catalog (20 October 2026)
5. BleepingComputer, CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers (21 October 2026)
6. Zach Main, Plex2Shell: Unauthenticated RCE in Plex Media Server (16 October 2026)
7. NVD, CVE-2026-96656 (Plex Media Server before 1.43.3.10861)
8. Plex forum, Plex Media Server 1.43.3.10861 is now available to everyone (4 August 2026)
9. BoredHackerBlog, Plex vulnerabilities being exploited in the wild to drop a cryptominer (17 October 2026)
10. CISA, Known Exploited Vulnerabilities Catalog (entries added 20 October 2026)
11. Plex, official Docker image README (pms-docker on GitHub)
12. Plex Support, Remote Streaming (Setting Up Remote Access)
13. ICO, What is personal information: a guide
14. Apple Support (UK), Erase your Mac and reset it to factory settings

This article is general information for Plex server owners, accurate as of 22 October 2026. It is not a substitute for advice from Plex or a security professional.