CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

According to The Hacker News, the four Plex flaws were added to the KEV catalog after a report from security researcher boredhackerblog, who found threat actors using them to deploy cryptocurrency miners and proxy malware[2]. The Hacker News reports that CISA wants federal civilian agencies to fix CVE-2026-96656 by October 23, 2026[2].SecurityOnline reports that attacks started on October 17, 2026, one day after researcher Zach Main published full details and proof-of-concept code for his "Plex2Shell" chain[3].Censys says the four flaws affect Plex Media Server before build 1.43.3.10861[4]. It describes CVE-2026-96656 as "an arbitrary file write through the transcoder preferences"[4] with a score of 7.2. The Hacker News lists the flaw at CVSS 8.6[2].According to Censys, the 7.2-rated flaw requires admin access, and the earlier flaws in the chain give an unauthenticated attacker that access[4].OpenCVE's record says the TranscoderH264Options preference is added to x264's option string on every transcode, and all .so files are run at startup without signature, execute bit or symbol checks[5].The Hacker News reports that Plex fixed the issues in Plex Media Server 1.43.3.10861, released on August 3, 2026[2]. Censys reports that Plex says an internet-reachable server older than 1.43.3.10861 should be treated as possibly compromised[4]. Censys adds that upgrading does not remove an implant already in the Codecs directory or revoke a leaked admin token[4].