CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

The CVE record listed on OpenCVE states that Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load.[2] According to the same record, the preference TranscoderH264Options is appended verbatim to x264's option string on every transcode[2], and at startup, all .so files are run without signature, execute bit, or symbol checks.[2]Strix lists the flaw as a high-severity vulnerability rated 7.2/10 on the CVSS scale.[3]SecurityOnline reports that attackers began exploiting Plex Media Server vulnerabilities on October 17, 2026, one day after researcher Zach Main published full details and PoC code for his "Plex2Shell" chain.[4] The outlet says the chain links four CVEs into unauthenticated remote code execution[4], and that a honeypot caught attackers dropping a cryptominer and a proxy tool.[4]According to BetaNews, the researcher reported the problem to Plex on July 27, and the company acknowledged it and paid a bounty on August 4.[1]Cord Cutters News reports that large numbers of internet-exposed servers continue to run vulnerable builds[5], even though Plex sent notices in September.SentinelOne advises users to upgrade to Plex Media Server 1.43.3.10861 or later[6]. Penligent warns that a patched build "does not remove a malicious process, restore an altered configuration, or invalidate every secret an attacker may already have obtained."[7]