Plex2Shell is on KEV. A 1.43.3 label is not the fix.

CISA added the four-CVE chain on 20 October. Plex already said internet-facing servers older than 1.43.3.10861 should be treated as compromised. The file write is due Friday and requires forensic triage.

RWP Ventures · 2026-10-21 · event 2026-10-20 · 12 min read · priority 9.0

Do not collapse five facts.

1. The overnight increment is KEV, not first exploitation. A public write-up landed 16 October. A honeypot saw the published chain on 17 October. Plex’s own forum update on 19 October already said the issues are actively and widely exploited and that an internet-facing server older than 1.43.3.10861 should be assumed compromised. CISA’s 20 October listing is the federal clock and the forensic-triage flag, not the first evidence.
2. 1.43.3 is not the fixed build. Unaffected starts at 1.43.3.10861. Earlier 1.43.3 builds, including 1.43.3.10828, remain in the affected range. Censys counted nearly 8,000 internet-facing hosts on that early 1.43.3 build — the population most likely to be marked patched in an asset register that only stores the three-part label.
3. CVE-2026-96656 is the Friday problem. CISA due dates: 23 October for 96654 and 96656; 3 November for 96652 and 96655. BOD 26-04 forensic triage required: Yes only on 96656. That is the file write into the Codecs directory. The two SSRFs do not carry the triage flag.
4. The patch closes the chain. It does not empty Codecs or revoke the admin token. Plex’s 19 October guidance is a clean reinstall path: clear Codecs, inspect Preferences.xml for unexpected transcoder options, sign out devices, change the Plex password. A current version string is not proof the implant is gone.
5. This is not a PLC event and it is not yesterday’s Siemens story. Software Center CVE-2026-110936 did join the same six-row KEV batch, due 3 November, forensic triage No. That is a catalog add on [yesterday’s Daily Top](/posts/2026-10-20-siemens-ssc-cve-2026-110936-clickfix/), not a new product. Plex Media Server is an endpoint and NAS process. A hit is not confirmed OT process impact. Confirmed payloads in public reporting are a cryptominer and a residential proxy, not ransomware.

The operator sentence: inventory every Plex Media Server by the four-part build, treat internet-facing hosts older than 1.43.3.10861 as incident cases, and do not close those cases on a version string.

What happened

Plex shipped Media Server 1.43.3.10861 in early August (Plex forum release notes 4 August; researcher timeline 3 August). The 1 September forum notice told owners of v1.43.2 and earlier to update, and said CVEs had been requested. Identifiers published 23 September. Zach Main’s Plex2Shell write-up and public proof-of-concept followed on 16 October.

CISA’s 20 October alert added six KEV rows. Four of them are this chain. The other two are CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition, due 23 October, forensic triage Yes) and CVE-2026-110936 (Siemens Software Center).

CISA descriptions, paraphrased from the catalog:

NVD for 96656: Plex Media Server before 1.43.3.10861. Preference TranscoderH264Options is appended to x264’s option string on every transcode. At startup, .so files in Codecs run without signature, execute-bit, or symbol checks. CWE-73. CNA is CISA. Credit: Zach Main. Vector is network with high privileges required on that single CVE — which is why the earlier three exist.

Plex, 19 October update to the September thread:

• The four issues, chained, let an unauthenticated remote attacker run code as the Plex Media Server process.
• 1.43.3.10861 and later are not affected.
• A public proof of concept was released 16 October.
• Since then, widespread attacks against internet-facing servers that have not been updated.
• Compromised servers have been used to run cryptocurrency miners and proxy software that routes other people’s traffic through the victim connection.
• If the server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.

boredhackerblog’s honeypot, 17 October, is the first public in-the-wild observation. The Hacker News, 19 October, independently relayed that account: exploitation used the published chain; a shell script pulled a miner payload named x12345 from 217.60.194[.]116; a second artifact named myawesomeproxy presented as a stealthy Linux reverse proxy. Source IPs in that write-up: 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222. Miner process name mylovelyminer; mining host ota.proxystream[.]st. Bitsight had previously flagged global.relay.proxystream[.]st in an AISURU/proxyware context. That is infrastructure overlap, not a confirmed actor identification. Reddit reports of mylovelyminer on Plex hosts are not, on the current record, proven Plex2Shell victims.

Windows and macOS can auto-update when that setting is on. Linux, NAS packages, and Docker need a manual install. Plex’s September Linux example still cites a 1.19.4 filename; do not copy it.

Why it matters

Individually the CVSS numbers look modest. The chain is worse than any single score because 96656 needs admin, and the earlier flaws produce that admin token from an unauthenticated request.

Three operational reasons this is the daily.

First, KEV plus vendor assume-compromise is a case-open instruction, not a patch ticket. BOD 26-04 tells FCEB agencies to check whether the asset was compromised before the patch on KEVs that grant total control after exploitation. CISA put that forensic-triage bit on 96656. Plex already told non-federal owners the same thing in plainer language: internet-facing and older than 10861 means assume compromise. Closing the change record on “now running 1.43.4” without Codecs, Preferences.xml, and token review is the failure mode.

Second, the remaining population did not move when the exploit went public. Censys, 20 October: about 324,000 internet-facing Plex Media Server hosts; United States about 44 percent; about 30 percent still on a vulnerable build the day before the write-up; under 2 percent of still-vulnerable hosts upgraded in the three days after the chain was published. Automatic updates pulled a large share in August. What is left is the NAS, Docker, and forgotten host class — including the ~8,000 on 1.43.3.10828.

Third, the proxy is the interesting payload. A miner is noisy and local. A residential proxy on a home NAS, a lab box, or a jump host is a path into whatever that process can reach: mounted shares, stored credentials, and, if the box is on a corporate VPN, the enterprise network. That last hop is ASSESSED, not confirmed in the public exploitation accounts. Do not upgrade it to a named campaign against industrial networks.

Who / what is affected

• Plex Media Server on every platform the vendor ships, including NAS packages and container images. CVE records name no other Plex product.
• Affected: all builds before 1.43.3.10861. Unaffected: 1.43.3.10861 and later.
• Internet-facing servers are the confirmed exploitation surface. LAN-only servers are not in the public wild-use accounts; they are still in the CVE range.
• Enterprise relevance is shadow IT: media servers on corporate NAS, engineering workstations, and home devices that reach company systems. That is an exposure class, not a confirmed victim sector list. CISA has not published a federal-agency victim count.
• OT / ICS: UNKNOWN. Do not treat a Plex compromise as process impact. Do not merge this with Siemens Software Center or with SafePay.

SiteGuard CVE-2026-106931 is a parallel KEV row, not this product. Vendor (EG Secure Solutions, 14 October): OS command injection in the statistics feature (default enabled), CVSS v4.0 8.5, local vector, root/SYSTEM. Fixed in Ver8.00 Update 5 (Apache/Nginx/IIS) and Ver7.00 Update 6 (FreeBSD). Due 23 October, forensic triage Yes. Japan-heavy installed base. No public actor, no census.

Technical context

High-level chain, from the CVE records, Main’s write-up, and Censys’s 20 October advisory. This is not an exploit recipe.

1. CVE-2026-96652 (CWE-918). Unauthenticated SSRF on /player/timeline. Any X-Plex-Token value; a full URL in protocol makes the server POST to an attacker-chosen destination.
2. CVE-2026-96654. searchOne does not neutralize encoded URI schemes, so an attacker can invoke other plugins and supply parameters. That is the step that yields the owner admin token.
3. CVE-2026-96655 (CWE-918). With that token, /video/:/transcode/universal becomes a second SSRF: fetch an attacker-hosted carrier (reported as a crafted video) from an arbitrary internal or external address.
4. CVE-2026-96656 (CWE-73). Admin-level write via TranscoderH264Options into the Codecs directory. Codecs .so / .dll load without signature checks.

Code execution is as the account running Plex Media Server. What that account can read is in scope: library paths, mounted shares, local secrets. CVE-2026-96651 (path traversal on /system/agents/media/get) was fixed in the same build. It is not in the researcher chain and not on KEV.

ATT&CK (defensive mapping, not a named-actor chart): initial access T1190 (exploit public-facing application); execution as the service user; ingress tool transfer T1105; possible use of the host as a proxy. No ransomware use on the KEV rows.

Threat / exploitation status

What defenders should do

1. Inventory by the four-part build, not 1.43.3. Plex Web → Settings → General. NAS app-store labels lie. Docker tags lie. 1.43.3.10828 is still in.
2. Patch to 1.43.3.10861 or newer. Prefer current stable. Windows/macOS: confirm auto-update actually applied. Linux/NAS/Docker: manual package from Plex downloads, not the 1.19.4 example in the September post.
3. If the host was internet-facing and older than 10861, open an incident. Plex: assume compromise. CISA: forensic triage on 96656. Do not skip this because the box is “just media.”
4. Hunt before you trust the new version.

- Processes started by Plex named myawesomeproxy, mylovelyminer, or x12345

- Unexpected .so / .dll in the Plex Codecs folder

- Unexpected transcoder / x264 options in Preferences.xml

- Outbound to 217.60.194[.]116, ota.proxystream[.]st, and the three source IPs above

- New listening ports or reverse-proxy binaries under the Plex user

1. Rebuild, do not just upgrade. Plex’s 19 October path: clean reinstall, clear Codecs, inspect preferences, sign out all devices, change the Plex account password. Treat the stolen admin token as disclosed.
2. Pull the box off the internet until that work is done. Remote access through a VPN you control is a different exposure than Plex relay / forwarded 32400. Shadow-IT NAS on a plant or office LAN should be found with the same inventory, then segmented.
3. Federal / BOD 26-04 clocks: 96654 and 96656 due 23 October; 96652 and 96655 due 3 November. SiteGuard 106931 is the other 23 October triage row. Siemens 110936 is due 3 November and does not replace yesterday’s AppData hunt.

RWP is not publishing exploit code, PoC links beyond the researcher write-up already in the CVE references, or a how-to for the transcoder write.

RWP assessment

High confidence that the four CVEs chain, that Plex 1.43.3.10861 closes them, that exploitation followed the 16 October write-up, and that CISA listed all four on 20 October with 96656 as the triage/due-Friday row.

Moderate confidence in Plex’s “widespread” wording: vendor-confirmed, corroborated by one instrumented honeypot plus secondary relays, without a public victim census. Censys’s still-vulnerable share is an exposure number, not a compromise number.

Low confidence in actor identity. Miner-plus-proxy is commodity. AISURU is an infrastructure note, not an attribution.

Confidence that this is not OT process impact: high. No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked the rest of the window because it is the unpublished KEV chain with a vendor assume-compromise statement, a Friday due date, and a remaining internet-facing population that did not patch when the PoC dropped. Siemens on KEV is a catalog add to a story we already published. SafePay is a joint TTP advisory on old, already-KEV edge bugs. PHP’s emergency release is not out at the time of this writing.

What we are watching

• Whether CISA or Plex publishes a real-victim count, or whether the proxy payload is observed pivoting off residential NAS into enterprise VPN.
• PHP emergency release, 21 October 14:00 UTC. PHP’s 20 October notice: two critical issues, both CVSS v4.0 9.2, details and fixed versions with the release. Huntress tracks the leak as CVE-2026-109618 / CVE-2026-109619 under the community name php2shell. PHP itself has not named those CVEs on php.net. In-the-wild exploitation at this writing: not confirmed by PHP. GitHub repositories claiming a PoC before the advisory are untrusted. If the release lands with mass scanning, that becomes tomorrow’s increment.
• #StopRansomware AA26-293A (SafePay), 20 October. FBI, CISA, USSS, LKA Rheinland-Pfalz, UK NCA / NW ROCU. ≥600 victims since August 2024 across critical-infrastructure sectors. Initial access: stolen/guessed passwords, Mullvad-sourced traffic, phishing, and already-patched bugs (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766). Useful IOC pack; not a new CVE.
• ConnectWise Trust Center 21 October 00:30 UTC. Cloud Backup, SaaS Security, and Cloud Management still suspended. No new IP, no new Application ID. Next vendor update due 13:00 UTC 21 October. Not a material increment on [19 October](/posts/2026-10-19-connectwise-new-ips-log-window/).
• SiteGuard 106931 exploitation details beyond “vendor confirmed.” Still UNKNOWN actor and census.

Sources

Primary: CISA 20 October KEV alert and JSON catalog 2026.10.20; Plex forum security notice (1 September, exploitation update 19 October); CVE/NVD records for 96652/96654/96655/96656; Zach Main Plex2Shell write-up; boredhackerblog 17 October honeypot. Independent relays: The Hacker News 19 and 21 October, SecurityWeek 19 October, Ars Technica 19 October, Censys 20 October exposure study. Parallel items: EG Secure Solutions SiteGuard alert, CISA AA26-293A, PHP 20 October notice, Huntress php2shell post, ConnectWise 21 October 00:30 UTC, yesterday’s Siemens Daily Top.