Plex2Shell (CVE-2026-96652): fix Plex on your VPS

What the Plex2Shell chain contains

The four flaws and the fix at a glance

Scroll the table

"My Plex is up to date": why that is not enough

Reading the installed version and updating, by environment

Scroll the table

Port 32400: what must stay closed

Close direct exposure in seven steps

1. 01

   Update first

   Apply the command for your environment from the table above, then sudo systemctl restart plexmediaserver. Then check the version with curl -s http://127.0.0.1:32400/identity: the version attribute must show 1.43.3.10861 or a newer version.

2. 02

   Measure the exposure

   ss -tlnp | grep 32400
   From another machine: nc -vz 203.0.113.10 32400 (replace the example address with your VPS's IPv4). A successful connection means Plex is exposed.

3. 03

   Turn off direct remote access in Plex

   In the server settings, disable direct remote access. Plex then stops trying to make the port reachable from the Internet.

4. 04

   Close the port in the firewall

   sudo ufw allow OpenSSH
sudo ufw deny 32400/tcp
sudo ufw enable
sudo ufw status numbered
   Allow SSH before enabling ufw, or you lock yourself out.

5. 05

   Under Docker, publish on the loopback

   In the Compose file, replace the published port with 127.0.0.1:32400:32400, then docker compose up -d --force-recreate. A ufw rule is not enough here: Docker goes first.

6. 06

   Check again from outside

   nc -vz 203.0.113.10 32400
   The connection must now fail or time out. If it still succeeds, the firewall is not what filters, or Docker still publishes the port.

7. 07

   Reconnect legitimate access

   The next two sections describe an authenticated reverse proxy for the browser and a VPN for the apps. Choose before reopening anything.

Reverse proxy or VPN: which to choose

A testable example: nginx with authentication

1. 08

   Install nginx and the password tool

   Debian / Ubuntu: sudo apt install nginx apache2-utils
   RHEL / AlmaLinux: sudo dnf install nginx httpd-tools

2. 09

   Create a user

   sudo htpasswd -c /etc/nginx/.plex-htpasswd alice
   The command asks for the password and writes the file nginx reads. Without the -c option, it adds a user to the existing file.

3. 10

   Write the virtual host

   In /etc/nginx/conf.d/plex.conf, a server block with listen 443 ssl;, server_name plex.your-domain.com;, auth_basic "Plex"; and auth_basic_user_file /etc/nginx/.plex-htpasswd;. In location /, add proxy_pass http://127.0.0.1:32400;, proxy_set_header Host $host;, proxy_http_version 1.1;, proxy_set_header Upgrade $http_upgrade; and proxy_set_header Connection "upgrade"; for WebSockets.

4. 11

   Get the certificate and reload

   sudo certbot --nginx -d plex.your-domain.com
sudo nginx -t && sudo systemctl reload nginx
   The subdomain's DNS must already point to the VPS before the certificate.

5. 12

   Test the three cases

   curl -sI https://plex.your-domain.com/ must answer 401.
   curl -s -o /dev/null -w '%{http_code}' https://plex.your-domain.com/player/timeline must also answer 401 without credentials.
   curl -sI -u alice https://plex.your-domain.com/ asks for the password, then answers 200 or a redirect.

Looking for a compromise that predates the fix

Seven checks, each with its command

• Unexpected child processes — ps -eo pid,ppid,user,lstart,args --forest | grep -B1 -A4 -i "plex media server". Normal children carry Plex names (transcoder, script host); an sh, a bash, a curl or a binary launched from /tmp is suspect.
• CPU usage — ps aux --sort=-%cpu | head -5. A non-Plex process that keeps the processor busy suggests a cryptominer; pgrep -a -i xmrig looks for the most widespread one, without ruling out a borrowed name.
• Unknown files in the Codecs folder — sudo ls -lat "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs". Plex stores its transcoding codecs there: a name you do not recognise, or a date unrelated to any transcode, deserves a look. Under Docker, the same path sits in the volume mounted on /config.
• Recent executables outside packages — sudo find /tmp /var/tmp /dev/shm /var/lib/plexmediaserver -xdev -type f -perm /111 -mtime -60 2>/dev/null. Any executable in these folders that you did not install needs an explanation.
• Outbound connections — sudo ss -tupn state established | grep -i plex then sudo ss -tupn state established. Look for connections to addresses you do not recognise, especially from a process that is not Plex.
• Service logs — sudo journalctl -u plexmediaserver --since "2026-10-01" | grep -iE "timeline|transcode|error". Look for repeated calls to /player/timeline or transcode errors with no playback in progress.
• Persistence — sudo crontab -l -u plex, sudo systemctl list-timers --all and sudo find /etc/systemd/system /etc/cron.d -mtime -60. A scheduled task or a recent service you did not create is a sign someone wants to come back.

If a trace appears: rebuild rather than clean

Troubleshooting: five situations we have met

• "plexmediaserver is already the newest version" while the version is old — the Plex repository is not configured on the machine. Download the package from Plex's official download page, then sudo apt install ./plexmediaserver_*.deb.
• The container still shows the old version after docker pull — docker pull downloads the image but does not replace the running container. Run docker compose up -d --force-recreate.
• Port 32400 is still reachable despite ufw deny — Docker writes its own rules and goes ahead of ufw. Publish the port on 127.0.0.1:32400:32400 as described above.
• Plex apps no longer find the server after the port is closed — they were looking for the public address. Go through a VPN and add the server by its tunnel address.
• nginx answers 401 to the apps but not to the browser — the apps do not handle HTTP Basic authentication. Keep the proxy for the browser and give the apps the VPN.

Sources, and what no vendor advisory says

Official documentation