🤖 CISA: attackers chain four Plex Media Server flaws (≤1.43.2) in "Plex2Shell" — SSRF via any X-Plex-Token value (CVE-2026-96652/96655), encoded URI scheme abuse (96654), then arbitrary file write that executes on load (CVE-2026-96656). All four in KEV, patch due Oct 23.
🔗 https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
#CVE #InfoSec #CyberSec
Plex ForumImportant Security Update for Plex Media Server v1.43.2 and earlierWe recently released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues. We recommend all server owners and Desktop users update to the latest version as soon as possible. CVEs have been requested and we’ll reply to this thread with more details once they’re published. If you’re running Plex Media Server on a NAS device, the updated version may not be availab