Search: CVE-2026-96656

Plex Media Server versions before 1.43.3.10861 contain a vulnerability that allows an admin user to write arbitrary files which may be executed on load. This occurs because the TranscoderH264Options preference is directly appended to x264's option string without validation, and at startup, all .so files are executed without signature, execute bit, or symbol checks. This flaw enables potential arbitrary code execution.

Multiple vulnerabilities in Plex Media Server version 1.43.2 and earlier are actively exploited in the wild to achieve remote code execution. Attackers chain four CVEs to deploy the XMRig cryptominer and a proxy tool named myawesomeproxy. Exploitation attempts began on October 17, 2026, with malicious payloads downloaded from known IP addresses. The proxy software may enable threat actors to use residential IPs to access corporate VPNs and email systems. Public proof-of-concept exploit code is available via the plex2shell project. No official patch or remediation information is currently provided.