Reporting checked against the linked primary sources on October 25, 2026. The incidents described occurred earlier that week.
News update — October 25, 2026. People who run their own Plex Media Server should verify that it has received the latest security updates. The US Cybersecurity and Infrastructure Security Agency (CISA) added multiple Plex-related vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, citing evidence of exploitation.
The issue concerns Plex Media Server, the software that hosts a personal library on a PC, NAS, or dedicated server. Simply using the Plex app to stream from somebody else’s server is not the same as hosting a vulnerable server yourself.
What is the problem?
Several flaws have been described together as the Plex2Shell chain. Security reporting and advisories describe combinations that could allow unauthorized actions on a vulnerable server. The affected issues include CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Plex previously published a security notice urging owners of older servers to update. Because older builds can remain installed on home NAS devices or machines that rarely get checked, people should not assume the presence of an automatic-update setting means the latest version is actually running.
What version should you use?
The Plex security notice says affected owners should update to Plex Media Server 1.43.3 or later. Multiple advisories identify 1.43.3.10861 as the build containing the relevant fixes. Updating to the newest supported stable version available for your device is preferable to stopping at an older minimum build.
If a NAS vendor’s app center has not offered the latest package, use Plex’s official update instructions and confirm compatibility with your device. For Docker installations, pull a clean updated image and recreate the container rather than restarting the same outdated image.
How to reduce risk
- Open the Plex Media Server dashboard and check the server version, not just the Plex player app version.
- Install the supported security update using Plex’s documentation or your device vendor’s trusted channel.
- Review whether your server needs public internet access. Limit exposure and disable features you do not use where practical.
- Look for unexpected server processes, unusual resource usage, or administrator-account changes. These signs are not proof of compromise on their own.
- If you suspect an intrusion, isolate the system and preserve evidence before rebuilding it.
A software update closes known flaws, but it does not automatically remove malware if an attacker already gained access. Owners who discover clear signs of compromise may need a more thorough incident response.
What is confirmed?
CISA’s KEV listing indicates evidence of exploitation of the listed vulnerabilities; it does not mean every old Plex server has been breached. It is still worth patching promptly because these servers often sit on home networks alongside personal computers and storage devices.
CyberUnpacked takeaway: check the version of the server that hosts your media library, not only the app you watch it with.
Sources
- Plex: Important Security Update for older Media Server versions
- CISA: Six vulnerabilities added to the KEV catalog on October 20
- Ars Technica: guidance for Plex owners