[{"data":1,"prerenderedAt":242},["ShallowReactive",2],{"seo-verification":3,"blog-plex2shell-cve-2026-96652-fix-plex-on-a-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-plex2shell-cve-2026-96652-fix-plex-on-a-vps-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":177,"ctaBody":178,"ctaButton":179,"ctaUrl":180,"relatedPosts":181},536,"plex2shell-cve-2026-96652-fix-plex-on-a-vps",{"fr":12,"en":10,"ar":13,"es":14},"plex2shell-cve-2026-96652-plex-vps-corriger","ثغرة-plex2shell-cve-2026-96652-تصحيح-plex-على-vps","plex2shell-cve-2026-96652-corregir-plex-en-un-vps","Plex2Shell (CVE-2026-96652): fix Plex on your VPS","Plex2Shell chains CVE-2026-96652 to -96656 in Plex Media Server. Check your version, close port 32400, hunt for an earlier intrusion: tested commands.",10,0,false,"2026-10-30T00:00:00+00:00","2026-10-31T01:54:05+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fplex2shell-cve-2026-96652-plex-vps-corriger-poster.svg","Plex2Shell is the name given to a chain of four flaws in Plex Media Server, the first of which, CVE-2026-96652, needs no authentication. According to BleepingComputer, the technical details were published in October 2026 and exploitation followed almost immediately, with a cryptominer being deployed. A VPS that exposes port 32400 to the Internet is the typical target. This guide gives you the commands to read your version, close direct exposure, then look for traces of an intrusion that predates the fix.",[35,39,71,74,97,100,125,128,146,149,160,163,171,174],{"type":36,"title":37,"body":38},"h2","What the Plex2Shell chain contains","According to BleepingComputer, which relays the CISA alert, the chain strings together four Plex Media Server flaws. The first, CVE-2026-96652, is a server-side request forgery (SSRF) on the `\u002Fplayer\u002Ftimeline` endpoint, reachable without authentication: a stranger can make your server send requests. The other three, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, extend the attack to arbitrary file writes in the transcoder parameters, which can lead to code execution. The critical score of 9.8 is the one the researcher gives to the whole chain, not an official score assigned to each flaw. The details have been public since October 2026, exploitation is reported from 17 October 2026, and CISA set 23 October 2026 as the remediation deadline for US federal agencies.",{"type":40,"title":41,"headers":42,"rows":46},"comparison","The four flaws and the fix at a glance",[43,44,45],"Reference","Nature","Role in the chain",[47,51,55,59,63,67],[48,49,50],"CVE-2026-96652","SSRF on `\u002Fplayer\u002Ftimeline`, unauthenticated","Entry point: no account required",[52,53,54],"CVE-2026-96654","URL injection in `searchOne`","Lets an attacker call other plugins' functions",[56,57,58],"CVE-2026-96655","Authenticated SSRF in the transcoder endpoint","Widens the reach of internal requests",[60,61,62],"CVE-2026-96656","Arbitrary file write through transcoder parameters","Last link: code execution possible",[64,65,66],"Fixed version","Plex Media Server 1.43.3.10861 or later","Every earlier version is vulnerable",[68,69,70],"Score of 9.8","Given to the whole chain by the researcher","Not an official score for each flaw",{"type":36,"title":72,"body":73},"\"My Plex is up to date\": why that is not enough","Updating closes the flaws, not the door, and removes nothing an intruder has already left behind. Three cases come up. The server was fixed after the details were published: if it was exposed and vulnerable in the meantime, it may have been compromised before your update. The server was never fixed, because Plex on Linux does not update itself and a container keeps the image it started with. Or the server is up to date, but port 32400 is still open to everyone when only your family uses it. So there are three steps: check the version, reduce exposure, look for traces.",{"type":40,"title":75,"headers":76,"rows":80},"Reading the installed version and updating, by environment",[77,78,79],"Environment","Read the installed version","Update",[81,85,89,93],[82,83,84],"Debian \u002F Ubuntu","`dpkg -s plexmediaserver | grep Version`","`sudo apt update && sudo apt install --only-upgrade plexmediaserver`",[86,87,88],"RHEL \u002F AlmaLinux","`rpm -q plexmediaserver`","`sudo dnf upgrade plexmediaserver` if the Plex repository is configured, otherwise the .rpm package from the official download page",[90,91,92],"Docker","`version` attribute of `curl -s http:\u002F\u002F127.0.0.1:32400\u002Fidentity` if the port is published","`docker pull plexinc\u002Fpms-docker` + `docker compose up -d --force-recreate`",[94,95,96],"All cases","`curl -s http:\u002F\u002F127.0.0.1:32400\u002Fidentity` returns a short XML with the `version` attribute","Then restart: `sudo systemctl restart plexmediaserver`",{"type":36,"title":98,"body":99},"Port 32400: what must stay closed","Plex listens on port 32400 by default. On a VPS the firewall is yours: with no rule, the port is reachable from the Internet, and a Docker container writes its own rules that bypass `ufw`. The command `ss -tlnp | grep 32400` shows whether Plex listens on all interfaces (`0.0.0.0` or `*`) or only on `127.0.0.1`. It does not prove the port is reachable from outside, since the firewall may filter it: the real test runs from another machine. With a dedicated IPv4 address, as on a VPS, this is the first check to make.",{"type":101,"title":102,"steps":103},"steps","Close direct exposure in seven steps",[104,107,110,113,116,119,122],{"title":105,"body":106},"Update first","Apply the command for your environment from the table above, then `sudo systemctl restart plexmediaserver`. Then check the version with `curl -s http:\u002F\u002F127.0.0.1:32400\u002Fidentity`: the `version` attribute must show 1.43.3.10861 or a newer version.",{"title":108,"body":109},"Measure the exposure","`ss -tlnp | grep 32400`\nFrom another machine: `nc -vz 203.0.113.10 32400` (replace the example address with your VPS's IPv4). A successful connection means Plex is exposed.",{"title":111,"body":112},"Turn off direct remote access in Plex","In the server settings, disable direct remote access. Plex then stops trying to make the port reachable from the Internet.",{"title":114,"body":115},"Close the port in the firewall","`sudo ufw allow OpenSSH`\n`sudo ufw deny 32400\u002Ftcp`\n`sudo ufw enable`\n`sudo ufw status numbered`\nAllow SSH before enabling `ufw`, or you lock yourself out.",{"title":117,"body":118},"Under Docker, publish on the loopback","In the Compose file, replace the published port with `127.0.0.1:32400:32400`, then `docker compose up -d --force-recreate`. A `ufw` rule is not enough here: Docker goes first.",{"title":120,"body":121},"Check again from outside","`nc -vz 203.0.113.10 32400`\nThe connection must now fail or time out. If it still succeeds, the firewall is not what filters, or Docker still publishes the port.",{"title":123,"body":124},"Reconnect legitimate access","The next two sections describe an authenticated reverse proxy for the browser and a VPN for the apps. Choose before reopening anything.",{"type":36,"title":126,"body":127},"Reverse proxy or VPN: which to choose","Both close port 32400 to the whole world, but they do not serve the same clients. A reverse proxy with authentication protects the Plex web interface in a browser, with TLS in front. Plex apps on TVs and phones cannot answer HTTP Basic authentication: behind that proxy, they fail. For them the VPN is the clean route: after `sudo apt install wireguard` and the peer configuration, the rule `sudo ufw allow in on wg0 to any port 32400 proto tcp` opens Plex only to the tunnel interface. Remember that the VPN covers every client, and the proxy only the browser.",{"type":101,"title":129,"steps":130},"A testable example: nginx with authentication",[131,134,137,140,143],{"title":132,"body":133},"Install nginx and the password tool","Debian \u002F Ubuntu: `sudo apt install nginx apache2-utils`\nRHEL \u002F AlmaLinux: `sudo dnf install nginx httpd-tools`",{"title":135,"body":136},"Create a user","`sudo htpasswd -c \u002Fetc\u002Fnginx\u002F.plex-htpasswd alice`\nThe command asks for the password and writes the file nginx reads. Without the `-c` option, it adds a user to the existing file.",{"title":138,"body":139},"Write the virtual host","In `\u002Fetc\u002Fnginx\u002Fconf.d\u002Fplex.conf`, a `server` block with `listen 443 ssl;`, `server_name plex.your-domain.com;`, `auth_basic \"Plex\";` and `auth_basic_user_file \u002Fetc\u002Fnginx\u002F.plex-htpasswd;`. In `location \u002F`, add `proxy_pass http:\u002F\u002F127.0.0.1:32400;`, `proxy_set_header Host $host;`, `proxy_http_version 1.1;`, `proxy_set_header Upgrade $http_upgrade;` and `proxy_set_header Connection \"upgrade\";` for WebSockets.",{"title":141,"body":142},"Get the certificate and reload","`sudo certbot --nginx -d plex.your-domain.com`\n`sudo nginx -t && sudo systemctl reload nginx`\nThe subdomain's DNS must already point to the VPS before the certificate.",{"title":144,"body":145},"Test the three cases","`curl -sI https:\u002F\u002Fplex.your-domain.com\u002F` must answer 401.\n`curl -s -o \u002Fdev\u002Fnull -w '%{http_code}' https:\u002F\u002Fplex.your-domain.com\u002Fplayer\u002Ftimeline` must also answer 401 without credentials.\n`curl -sI -u alice https:\u002F\u002Fplex.your-domain.com\u002F` asks for the password, then answers 200 or a redirect.",{"type":36,"title":147,"body":148},"Looking for a compromise that predates the fix","BleepingComputer gives no specific indicator, no hash, address or domain, so we cannot hand you a list of signatures to search for. What remains is behaviour, and it speaks. A media server does not launch a shell, does not download anything in the background, does not burn a whole core continuously and does not contact unknown addresses. Examine the period running from the vulnerable version, and at the very least from the publication of the details in October 2026. No trace does not prove there was no intrusion, since a miner can be renamed; a trace, on the other hand, is a confession.",{"type":150,"title":151,"items":152},"ul","Seven checks, each with its command",[153,154,155,156,157,158,159],"**Unexpected child processes** — `ps -eo pid,ppid,user,lstart,args --forest | grep -B1 -A4 -i \"plex media server\"`. Normal children carry Plex names (transcoder, script host); an `sh`, a `bash`, a `curl` or a binary launched from `\u002Ftmp` is suspect.","**CPU usage** — `ps aux --sort=-%cpu | head -5`. A non-Plex process that keeps the processor busy suggests a cryptominer; `pgrep -a -i xmrig` looks for the most widespread one, without ruling out a borrowed name.","**Unknown files in the Codecs folder** — `sudo ls -lat \"\u002Fvar\u002Flib\u002Fplexmediaserver\u002FLibrary\u002FApplication Support\u002FPlex Media Server\u002FCodecs\"`. Plex stores its transcoding codecs there: a name you do not recognise, or a date unrelated to any transcode, deserves a look. Under Docker, the same path sits in the volume mounted on `\u002Fconfig`.","**Recent executables outside packages** — `sudo find \u002Ftmp \u002Fvar\u002Ftmp \u002Fdev\u002Fshm \u002Fvar\u002Flib\u002Fplexmediaserver -xdev -type f -perm \u002F111 -mtime -60 2>\u002Fdev\u002Fnull`. Any executable in these folders that you did not install needs an explanation.","**Outbound connections** — `sudo ss -tupn state established | grep -i plex` then `sudo ss -tupn state established`. Look for connections to addresses you do not recognise, especially from a process that is not Plex.","**Service logs** — `sudo journalctl -u plexmediaserver --since \"2026-10-01\" | grep -iE \"timeline|transcode|error\"`. Look for repeated calls to `\u002Fplayer\u002Ftimeline` or transcode errors with no playback in progress.","**Persistence** — `sudo crontab -l -u plex`, `sudo systemctl list-timers --all` and `sudo find \u002Fetc\u002Fsystemd\u002Fsystem \u002Fetc\u002Fcron.d -mtime -60`. A scheduled task or a recent service you did not create is a sign someone wants to come back.",{"type":36,"title":161,"body":162},"If a trace appears: rebuild rather than clean","A cryptominer found proves an intrusion, but not that it was limited to the miner. First isolate the server: `sudo ufw default deny incoming`, with SSH allowed from your address only. Export the logs before they rotate, for example with `sudo journalctl -u plexmediaserver > plex-journal.txt`. Then rebuild the VPS from a clean image, install the fixed version before opening anything, and restore only your media and the library database after review. Finally, change everything the service account could read: SSH keys, Plex password, tokens and environment secrets. A server hardened on the Plex side is still exposed if the kernel does not keep up: see our article on the Fragnesia kernel flaw.",{"type":150,"title":164,"items":165},"Troubleshooting: five situations we have met",[166,167,168,169,170],"**\"plexmediaserver is already the newest version\" while the version is old** — the Plex repository is not configured on the machine. Download the package from Plex's official download page, then `sudo apt install .\u002Fplexmediaserver_*.deb`.","**The container still shows the old version after `docker pull`** — `docker pull` downloads the image but does not replace the running container. Run `docker compose up -d --force-recreate`.","**Port 32400 is still reachable despite `ufw deny`** — Docker writes its own rules and goes ahead of `ufw`. Publish the port on `127.0.0.1:32400:32400` as described above.","**Plex apps no longer find the server after the port is closed** — they were looking for the public address. Go through a VPN and add the server by its tunnel address.","**nginx answers 401 to the apps but not to the browser** — the apps do not handle HTTP Basic authentication. Keep the proxy for the browser and give the apps the VPN.",{"type":36,"title":172,"body":173},"Sources, and what no vendor advisory says","We did not find a Plex security advisory that lists these CVEs. The only vendor item we found is the announcement of version 1.43.3.10861 on the Plex forum, published on 4 August 2026: it mentions neither a flaw nor a CVE. The fixed version number, the mapping of the four CVEs and the score come from BleepingComputer, which cites CISA and the researcher: cross-check with the vendor as soon as it publishes. We give no date for the addition to the KEV catalog, as we could not confirm it on the CISA catalog. And if you would rather leave Plex than harden it, our Jellyfin migration guide covers that separately.",{"type":36,"title":175,"body":176},"Official documentation","BleepingComputer article on Plex2Shell: https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers\n\nAnnouncement of version 1.43.3.10861 on the Plex forum: https:\u002F\u002Fforums.plex.tv\u002Ft\u002Fplex-media-server\u002F30447\u002F713\n\nCISA Known Exploited Vulnerabilities catalog: https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog\n\nPlex Media Server download: https:\u002F\u002Fwww.plex.tv\u002Fmedia-server-downloads\u002F\n\nnginx auth_basic module: https:\u002F\u002Fnginx.org\u002Fen\u002Fdocs\u002Fhttp\u002Fngx_http_auth_basic_module.html\n\nDocker and firewalls: https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fnetwork\u002Fpacket-filtering-firewalls\u002F\n\nWireGuard quick start: https:\u002F\u002Fwww.wireguard.com\u002Fquickstart\u002F","A VPS where you decide what is exposed","With a ServOrbit.com VPS you get root, a dedicated IPv4 address and a firewall of your own: you choose what reaches the Internet and can isolate the media server. VPS administration is available as an option for those who do not want to harden alone; it is not included. Guide provided, no hands-on support.","See Cloud VPS plans","\u002Fvps-cloud",[182,202,222],{"id":183,"slug":184,"slugs":185,"title":189,"excerpt":190,"readTime":23,"views":18,"isPinned":19,"publishedAt":191,"updatedAt":192,"category":193,"categories":199,"featuredImage":30,"bgImage":31,"posterImage":201,"relatedSolution":30},394,"plex-security-migration-jellyfin-navidrome-vps",{"fr":186,"en":184,"ar":187,"es":188},"plex-securite-migration-jellyfin-navidrome-vps","امان-plex-هجرة-jellyfin-navidrome-vps","seguridad-plex-migrar-jellyfin-navidrome-vps","Migrate Plex to Jellyfin and Navidrome on a VPS","36,000 Plex servers unpatched against CVE-2026-96656 and CVE-2026-96651. Complete guide to migrate video and music libraries to Jellyfin and Navidrome on a root VPS.","2026-09-28T00:00:00+00:00","2026-10-21T15:21:31+00:00",{"id":194,"name":195,"slug":196,"color":197,"icon":198},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[200],{"id":194,"name":195,"slug":196,"color":197,"icon":198},"\u002Fblog\u002Fcovers\u002Fplex-securite-migration-jellyfin-navidrome-vps-poster.svg",{"id":203,"slug":204,"slugs":205,"title":209,"excerpt":210,"readTime":211,"views":212,"isPinned":19,"publishedAt":213,"updatedAt":214,"category":215,"categories":216,"featuredImage":30,"bgImage":31,"posterImage":218,"relatedSolution":219},292,"migrating-from-plex-to-jellyfin-after-the-july-2026-paywall",{"fr":206,"en":204,"ar":207,"es":208},"migrer-plex-vers-jellyfin-2026","الهجرة-من-plex-إلى-jellyfin-بعد-paywall-يوليو-2026","migrar-de-plex-a-jellyfin-2026","Migrating from Plex to Jellyfin after the July 2026 paywall","Plex put remote streaming behind a paywall in July 2026. Here's how to migrate to Jellyfin on your VPS: library intact, same clients, remote access restored.",9,4,"2026-08-22T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":194,"name":195,"slug":196,"color":197,"icon":198},[217],{"id":194,"name":195,"slug":196,"color":197,"icon":198},"\u002Fblog\u002Fcovers\u002Fmigrer-plex-vers-jellyfin-2026-poster.svg",{"categorySlug":220,"appSlug":221},"collaboration-productivity","jellyfin",{"id":223,"slug":224,"slugs":225,"title":229,"excerpt":230,"readTime":23,"views":231,"isPinned":19,"publishedAt":232,"updatedAt":233,"category":234,"categories":239,"featuredImage":30,"bgImage":31,"posterImage":241,"relatedSolution":30},98,"jellyfin-vs-plex-which-self-hosted-media-server",{"fr":226,"en":224,"ar":227,"es":228},"jellyfin-vs-plex","jellyfin-مقابل-plex-أي-خادم-وسائط-مستضاف-ذاتيا","jellyfin-vs-plex-que-servidor-multimedia-autoalojado","Jellyfin vs Plex: Which Self-Hosted Media Server?","Jellyfin vs Plex: complete comparison to choose your self-hosted media server on a VPS — Docker deployment, troubleshooting, and Jellyfin 12 migration.",1,"2026-03-14T00:00:00+00:00","2026-09-10T13:10:43+00:00",{"id":235,"name":236,"slug":237,"color":238,"icon":237},5,"Comparison","comparatif","bg-info\u002F10 text-info",[240],{"id":235,"name":236,"slug":237,"color":238,"icon":237},"\u002Fblog\u002Fcovers\u002Fjellyfin-vs-plex-poster.svg",1793414279191]