Plex Media Server owners: update now. “Plex2Shell” is a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that is being actively exploited. Every version older than 1.43.3.10861 is affected. In this video Dr Husham Memar shows how to check your version, update on Windows, Mac, Linux, NAS, Docker and NVIDIA Shield, and lock your server down. It covers the fix only, with no attack steps.
Quick check: Plex Web › Settings › General › version 1.43.3.10861 or newer.
Updating alone doesn’t clean a server that was outdated and exposed to the internet. Warning signs: unknown processes started by Plex, unfamiliar .so or .dll files in the Codecs folder, outgoing connections to proxystream.st (named in Plex’s 19 Oct advisory update), high CPU while idle. Codecs folder locations:
• Windows: %LOCALAPPDATA%Plex Media ServerCodecs
• Mac: ~/Library/Application Support/Plex Media Server/Codecs
• Linux: /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs
• Synology DSM 7: /volume1/PlexMediaServer/AppData/Plex Media Server/Codecs
Full write-up: www.husham.com/plex2shell-plex-media-server-vulnerability-update-check-codecs-folder/
CHAPTERS:
0:00 Intro: Plex2Shell Is Being Exploited
0:42 What Plex2Shell Is & Who’s Affected
1:39 Step 1: Check Your Plex Version
2:11 Step 2: Update on Windows, Mac & Linux
2:49 Updating on NAS, Docker & NVIDIA Shield
3:31 Step 3: Lock Down Your Plex Server
4:22 Final Checklist & Outro
đź“° Official sources:
• Plex security advisory: forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
• CISA KEV alert (20 Oct 2026): www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
• Plex downloads: www.plex.tv/media-server-downloads/
• Plex Docker image: github.com/plexinc/pms-docker
đź”— Official Links & Store:
• Subscribe: www.youtube.com/@husham122
• Website: husham.com/
• Forum: forum.husham.com/
• Store: hushamelectronics.com/product-category/firestick-alternatives-android-tv-streaming/
🔒 Get a VPN (Husham’s VPN deals):
• NordVPN: www.husham.com/go/nordvpn
• Surfshark VPN: www.husham.com/go/surfshark (or Fire TV: www.husham.com/go/surfshark-firetv | IPTV: www.husham.com/go/surfshark-iptv)
• IPVanish: www.husham.com/ipvanishpromo
• CyberGhost VPN: www.husham.com/cgdiscount
• PureVPN: www.husham.com/purevpn
• Ivacy VPN: www.husham.com/ivacyvpn
• NordPass (password manager): www.husham.com/go/nordpass
Some links are affiliate links: I may earn a small commission at no extra cost to you. This channel does not support piracy or unauthorised streaming; only use official apps and content you have the legal right to access.
source
