Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)

Plex Media Server 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value. id:...

ShellSCope

SHELLSCOPE / || | | | | | | | / | / || | | \ | || | | | | | | \ | | | | | | | | || | | | | | | | | |/|| ||||||/ ||| \| 2shell exposure auditor — find your own before they find you. shellscope checks an authorized network for two 2026 CVE clusters: Plex2Shell — CVE-2026-96652 / -96654 / -96655...

plex2shell_pcap

plex2shellpcap pcap artifacts for plex2shell exploitation As of Oct 17th, 2026, this is being exploited in the wild but pcaps with name containing "lab" are from lab testing!! regarding in the wild exploitation: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html...

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept PoC went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involve...