Plex2Shell: Update Plex Media Server to 1.43.3.10861 Now, Then Check Your Codecs Folder

October 24, 2026 Comments Off on Plex2Shell: Update Plex Media Server to 1.43.3.10861 Now, Then Check Your Codecs Folder
Synology DiskStation NAS of the kind many people run Plex Media Server on, with text telling owners to update Plex to 1.43.3.10861
Plex2Shell affects Plex Media Server builds older than 1.43.3.10861 on every platform, NAS boxes included. Photo: DYVER / Wikimedia Commons, CC BY-SA 4.0. husham.com stamp.
Contents hide
1 What actually happened
2 The four CVEs in plain English
3 Which versions are affected
4 How to update, platform by platform
5 Check for signs of compromise
6 Where to find the Codecs folder
7 If you were exposed and out of date, assume the worst
8 Hardening tips for afterwards
9 Do you need a VPN for this?
10 Quick checklist
11 Best IPTV boxes to buy

If you run Plex Media Server and you can watch your films from outside the house, stop what you are doing for ten minutes. A chain of four bugs nicknamed Plex2Shell lets someone on the internet, with no account and no password, run their own code on your server. Plex says it is being “actively and widely exploited” right now. The fix has been sitting in your update menu since September, which is the tech industry’s favourite way of saying “we did tell you”.

The short version: update to Plex Media Server 1.43.3.10861 or newer, then check your Codecs folder, because updating does not evict anyone who already moved in.

What actually happened

Security researcher Zach Main (zmain) reported the issues to Plex on 27 July 2026. Plex acknowledged them and paid a bounty on 4 August, released Plex Media Server 1.43.3 with the fixes and announced it on its forum on 1 September, and the CVE numbers were assigned on 23 September. The researcher published his full write up and a public proof of concept on 16 October. On 19 October Plex updated its advisory to confirm widespread attacks against internet facing servers that had not been updated.

On 20 October the US Cybersecurity and Infrastructure Security Agency (CISA) added all four Plex CVEs to its Known Exploited Vulnerabilities catalogue. US federal agencies had until 23 October to fix CVE-2026-96654 and CVE-2026-96656, and have until 3 November for CVE-2026-96652 and CVE-2026-96655. When CISA puts your home media server on the same list as enterprise firewalls, it is time to stop putting off that update.

I am not going to explain how the attack works step by step. You do not need that to protect yourself, and the people who want it already have it.

The four CVEs in plain English

This is how Plex itself describes them:

  • CVE-2026-96652: unauthenticated server side request forgery in the player timeline endpoint. In other words, a stranger can make your server send requests on their behalf.
  • CVE-2026-96654: access to internal agent functions over the loopback interface, meaning features meant only for the server talking to itself.
  • CVE-2026-96655: disclosure of the server owner’s admin token.
  • CVE-2026-96656: arbitrary file write to the Codecs directory through transcoder preferences.

Chained together, Plex says, they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process. The researcher rates the full chain 9.8 out of 10 on CVSS 3.1. The NVD entry for the first bug on its own shows a lower CISA score, because one link in a chain looks harmless until you see the whole chain. Rather like a single biscuit.

Which versions are affected

  • Affected: every Plex Media Server build older than 1.43.3.10861. The researcher’s own notes name 1.43.3.10828 as the newest vulnerable build he tested.
  • Fixed: 1.43.3.10861 and later.
  • Most at risk: servers reachable from the internet, typically through Remote Access or a forwarded port 32400.

To check your version, open Plex Web, go to Settings → General and look at the version number shown.

How to update, platform by platform

  • Windows and macOS: if automatic updates are on, confirm you are actually on the new build. If not, download the latest Plex Media Server from the Plex Downloads page and install it over the top.
  • Linux (Ubuntu, Debian, Fedora, CentOS): update through the Plex repository with your package manager, or install the latest package from the Downloads page.
  • Docker: pull the current image and recreate the container, following Plex’s pms-docker instructions on GitHub. Restarting an old container is not updating it.
  • NAS (Synology, QNAP, TerraMaster, WD, Netgear, ASUSTOR): Plex warns your NAS app store may lag behind. Download the right package from the Plex Downloads page and use the manual install option in your NAS web interface.
  • NVIDIA Shield: open Google Play and install any pending updates.

Check for signs of compromise

Plex lists these warning signs:

  • Processes started by Plex Media Server that you do not recognise. Plex names myawesomeproxy, mylovelyminer and x12345. Criminals, it turns out, are not great at naming things either.
  • Unfamiliar .so or .dll files in the Plex Codecs folder.
  • Outbound connections to proxystream.st, or sustained high CPU while nothing is playing.

Attackers have been using hijacked servers to run cryptocurrency miners and proxy software, which routes other people’s traffic through your home internet connection. So if your broadband has felt sluggish and your server fan sounds like a hairdryer, that may not be the weather.

Where to find the Codecs folder

The Codecs folder sits inside the Plex Media Server data directory. Plex’s default locations are:

  • Windows: %LOCALAPPDATA%\Plex Media Server\Codecs
  • macOS: ~/Library/Application Support/Plex Media Server/Codecs (in Finder use Go, then Go to Folder)
  • Linux (Debian, Ubuntu, Fedora, CentOS): /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs
  • Snap: inside /var/snap/plexmediaserver/common/Library/Application Support
  • Docker: wherever you mapped the config volume, usually under Library/Application Support/Plex Media Server/Codecs inside it
  • Synology DSM 7: /volume1/PlexMediaServer/AppData/Plex Media Server/Codecs
  • Synology DSM 6: /volume1/Plex/Library/Application Support/Plex Media Server/Codecs
  • QNAP: run getcfg -f /etc/config/qpkg.conf PlexMediaServer Install_path over SSH and add /Library/Plex Media Server to the result

Plex downloads codecs automatically, so this folder is not empty on a healthy server. The point is that you should not be the one guessing what belongs there, which is why Plex’s advice below is to clear it out.

If you were exposed and out of date, assume the worst

Plex’s own words: if your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised. If you see any warning signs, or you cannot rule it out:

  1. Rebuild from a clean installation rather than reusing the old Plex data directory.
  2. At minimum, delete everything in the Codecs folder and check Preferences.xml (in the same data directory) for transcoder options you did not set.
  3. Sign out of all devices from your Plex account settings and change your Plex password.
  4. Treat anything the Plex service account could reach as exposed, including mounted shares and credentials stored on the same machine or VM.

Yes, updating alone is not enough. Patching a hole does not remove whoever already climbed through it.

Hardening tips for afterwards

  • Turn off Remote Access under Settings → Remote Access if you only watch at home.
  • Avoid forwarding port 32400 directly on your router unless you genuinely need it.
  • Keep automatic updates on, and actually check the version once a month.
  • Run Plex under its own limited account and only give it read access to your media folders, so a bad day stays a small bad day.
  • Keep Plex away from your important stuff: no saved passwords or work files on the same box if you can help it.

Do you need a VPN for this?

A VPN will not patch Plex and will not clean a compromised server, so update first. Where it does help is the other side of the habit: if you watch your own media or your own paid subscriptions on hotel or café WiFi, a VPN such as NordVPN, Surfshark, IPVanish, CyberGhost or PureVPN keeps that connection private. Some VPNs and routers also let you reach your home network privately instead of opening ports to the whole internet, which is a far better idea than port 32400 waving at every scanner on the planet.

Quick checklist

  1. Settings → General: is it 1.43.3.10861 or newer? If not, update now.
  2. Look for strange processes, unfamiliar .so or .dll files in Codecs, odd outbound traffic or high idle CPU.
  3. Exposed and out of date? Rebuild clean, or at least wipe Codecs and check Preferences.xml.
  4. Sign out of all devices and change your Plex password.
  5. Turn off Remote Access if you do not need it.

Best IPTV boxes to buy

These are media boxes and sticks that can run players and licensed apps. The first six are Google certified Android TV or Google TV devices with Google Play; the last one, the Formuler, runs its own Android and is not certified. They are not pirate hardware. They do not come with channels or playlists. I am not claiming I personally lab-tested every SKU this month.

Buy one of these when: Fire TV sideload is a hassle on your model, you want Play Store apps on a proper TV OS, or you want a dedicated player shell behind the sofa. No Fire TV device is on this shortlist.

Still shopping for a Fire TV device? Fine for Prime Video and the Appstore universe. Not the shortlist above. And none of these boxes magically make unlicensed streams legal.

Sources I read for this piece, all on 24 October 2026: Plex’s forum advisory “Important Security Update for Plex Media Server v1.43.2 and earlier” (posted 1 September 2026, updated 19 October 2026); Plex Support, “Where is the Plex Media Server data directory located?”; the NVD record for CVE-2026-96652; CISA’s alert “CISA Adds Six Known Exploited Vulnerabilities to Catalog” (20 October 2026) and its KEV catalogue entries; and Zach Main’s Plex2Shell write up on zmain.info and his project page. Featured image: Synology DiskStation DS223j by DYVER, Wikimedia Commons, CC BY-SA 4.0, with husham.com text overlay and stamp.

Disclosure: some links on this page are affiliate links. If you buy through them, husham.com may earn a commission at no extra cost to you.

Written by Dr Husham Memar

Related Articles