Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Threat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software.