A public Plex2Shell exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 for unauthenticated RCE on exposed Plex Media Server instances. Active exploitation means any internet-facing unpatched server should be treated as at-risk and prioritized for patching and exposure review. #Plex2Shell #PlexSecurity #RemoteCodeExecution
https://cyberworldops.eu/en/public-plex2shell-exploit-used-to-compromise-exposed-plex-media
CyberWorldOpsPublic Plex2Shell Exploit Observed on Plex HoneypotResearchers observed public Plex2Shell exploit used against a Plex honeypot to deploy XMRig miner and proxy software, per single-server data.