{"metadata": {"vulnerability": "CVE-2026-96652", "count": 43, "kinds": {"milestone": 4, "sighting": 15, "kev": 11, "other": 13}}, "data": [{"timestamp": "2026-08-03T00:00:00Z", "date_only": false, "value": "2026-08-03T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96652", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-14T18:19:53.437Z", "date_only": false, "value": "2026-09-14T18:19:53.437351Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96652", "field": "containers.cna.metrics.2.other.content.timestamp"}, {"timestamp": "2026-09-14T18:19:53.437Z", "date_only": false, "value": "2026-09-14T18:19:53.437351Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96652", "record": "FKIE_CVE-2026-96652", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-23T14:42:11.354Z", "date_only": false, "value": "2026-09-23T14:42:11.354Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96652", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T16:06:15.517Z", "date_only": false, "value": "2026-09-23T16:06:15.517Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96652", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T16:06:15.517Z", "date_only": false, "value": "2026-09-23T16:06:15.517Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisa-cg", "record": "CVE-2026-96652", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T17:17:23Z", "date_only": false, "value": "2026-09-23T17:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5P7W-R379-3C2M", "record": "GHSA-5P7W-R379-3C2M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-23T17:17:23.363Z", "date_only": false, "value": "2026-09-23T17:17:23.363", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96652", "record": "FKIE_CVE-2026-96652", "field": "published"}, {"timestamp": "2026-09-23T18:31:57Z", "date_only": false, "value": "2026-09-23T18:31:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5P7W-R379-3C2M", "record": "GHSA-5P7W-R379-3C2M", "field": "published"}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-96652", "field": "timestamps.asserted_at", "uuid": "09701585-1f99-469a-b808-29da06ab2361", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-96652", "field": "evidence.0.details.added_date", "uuid": "09701585-1f99-469a-b808-29da06ab2361", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-96652", "field": "timestamps.first_seen_at", "uuid": "09701585-1f99-469a-b808-29da06ab2361", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T11:49:00Z", "date_only": false, "value": "2026-10-19T11:49:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-96652", "field": "status.status_updated_at", "uuid": "09701585-1f99-469a-b808-29da06ab2361", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-19T13:25:26.292Z", "date_only": false, "value": "2026-10-19T13:25:26.292775Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "b8619cf2-a13b-44d3-9169-e7965abb6121", "content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n#threatintel #plex #IOC #eitw", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392"}, {"timestamp": "2026-10-19T15:06:51.016Z", "date_only": false, "value": "2026-10-19T15:06:51.016754Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117468195090277164", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "d87a8ddf-6047-4bb1-b602-f4fbdc7c1e97", "content": "Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure\nThreat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within a day of technical details and a working exploit becoming public, SecurityWeek reports. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be combined to run arbitrary code on exposed servers without credentials, and a honeypot observed attackers installing a cryptominer and proxy software. https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/", "url": "https://infosec.exchange/users/edwardk/statuses/117468195090277164"}, {"timestamp": "2026-10-19T19:02:36Z", "date_only": false, "value": "2026-10-19T19:02:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/gmolveau/b02c2e58b877cf138e2859dbfb5cc20e", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "6556ee8c-0f2e-40a3-b04d-92b628bdd389", "content": "# Is my Plex server hacked?\n\nA one-file, read-only script (`plex-check.sh`) you can run on any server to check\nwhether a **Plex Media Server** install shows signs of compromise via the\n**Plex2Shell** exploit chain and the malware dropped by it in the wild.\n\n## Background: what is Plex2Shell?\n\nIn October 2026, a chain of four Plex Media Server bugs was published with a working\nPoC (CVE-2026-96652, -96654, -96655, -96656). Chained together, they allow **unauthenticated\nremote code execution** on any exposed Plex server running:\n\n```\nPlex Media Server < 1.43.3.10861      (including 1.43.3.10828!)\n```\n\nExploitation began in the wild on Oct 17, 2026 \u2014 two days after the PoC went public \u2014\ndropping an **XMRig Monero miner** and a residential proxy called **myawesomeproxy**.\n\nPatched build: **1.43.3.10861** (current latest: 1.43.4.10903).\n\n## What the script checks\n\nAll checks are strictly **read-only** \u2014 nothing is modified on your machine.\n\n| # | Check | What it looks for |\n|---|-------|-------------------|\n| 1 | Plex install(s) | Docker containers and native (package/systemd) installs |\n| 2 | Plex version | Anything below 1.43.3.10861 = vulnerable |\n| 3 | Processes | `xmrig`, `myawesomeproxy`, `stratum+tcp`, miners, suspicious `/tmp` binaries |\n| 4 | Files | Miner/proxy artifacts in `/tmp`, `/var/tmp`; non-standard `.so`/`.sh` files dropped in the Plex **Codecs** folder (the attack writes a malicious library there) |\n| 5 | Network | Established connections on known mining ports (3333, 14444, 14433, 45700), processes connecting from `/tmp` |\n| 6 | Plex logs | Exploit signatures (`/video/:/transcode/universal` SSRF with an external `url=` parameter, junk `X-Plex-Token`, `myawesomeproxy`) |\n| 7 | Persistence | Recently modified `authorized_keys`, cron entries referencing `curl`/`wget`/`/tmp` |\n\nChecks it cannot perform are reported as `[SKIP]` with an explanation \u2014 they\nrequire root (run `sudo bash plex-check.sh`) or are unavailable inside a container.\n\n## How to run\n\nCopy the script onto the machine running Plex, then:\n\n```bash\nbash plex-check.sh\n```\n\nFor the deepest checks (native Plex logs, root-owned folders, cron):\n\n```bash\nsudo bash plex-check.sh\n```\n\nRequirements: `bash`, GNU `find`/`grep`/`sed`. Linux is the target platform;\non other platforms it degrades to fewer (or `[SKIP]`ed) checks.\n\n### Exit codes (useful for automation)\n\n| Code | Meaning |\n|------|---------|\n| 0 | No compromise indicators found |\n| 1 | Action needed: vulnerable version and/or compromise indicators |\n| 2 | Plex Media Server not detected on this machine |\n\n## Reading the output\n\n- `[PASS]` \u2014 check confirmed clean.\n- `[WARN]` \u2014 something exists that *could* be an indicator but is often\n  legitimate (recently changed `authorized_keys`, cron entries that use\n  `curl`, \u2026). Look at them and confirm they are yours.\n- `[FAIL]` \u2014 either your Plex version is vulnerable, or a known compromise\n  indicator was found. Act on it.\n- `[SKIP]` \u2014 the check could not run in this environment.\n\n## What to do if a check fails\n\n**Vulnerable version but no [FAIL] IOCs:**\n1. Upgrade Plex to \u2265 1.43.3.10861 immediately (latest release is best).\n2. Disable **Settings \u2192 Remote Access** if you don't need it.\n3. Change your plex.tv password (Plex suffered a data breach in 2022).\n\n**Any [FAIL] IOC fired (processes, files, network, logs):**\n1. **Isolate the machine** from the network first \u2014 do not delete evidence yet.\n2. Assume the `plex.tv` token and any credentials the Plex user could reach\n   are stolen. Rotate them from a clean machine.\n3. Reinstall from scratch:\n   - Docker: delete the container **and** its data volume/directory, pull a\n     fresh image, recreate.\n   - Native: back up your media (not the config), wipe the OS or at least the\n     plex data dir + user, reinstall current Plex.\n4. If the same machine holds other services (SSH keys, VPN configs\u2026), audit\n   those too \u2014 the exploit runs as the `plex` user, but drop more payload\n   once inside.\n\n## False positives to expect\n\n- The Codecs folder legitimately contains standard Plex codec libraries\n  named `lib*_decoder.so` / `lib*_encoder.so` \u2014 those are filtered out; only\n  *unexpected* names are flagged.\n- `authorized_keys`/cron WARNs assume attackers like persistence, but you\n  probably also touched your own keys recently \u2014 that's fine.\n\n## For the paranoid / manual verification\n\n```bash\n# exact version\ncurl -s http://SERVER_IP:32400/identity | grep version=\n\n# what's inside the container\ndocker top \n\n# exploit signatures in the last 3 days of logs\ndocker logs  --since 72h 2>&1 \\\n  | grep -iE 'transcode/universal\\?[^ ]*url=(https?|ftp|gopher)|myawesomeproxy'\n```\n\n\n#!/usr/bin/env bash\n#\n# plex-check.sh \u2014 read-only compromise check for Plex Media Server\n#\n# Checks whether a Plex install shows signs of compromise via the\n# \"Plex2Shell\" exploit chain (CVE-2026-96652 / -96654 / -96655 / -96656)\n# and the malware dropped in the wild (XMRig miner, \"myawesomeproxy\").\n#\n# Vulnerable:     Plex Media Server < 1.43.3.10861 (including 1.43.3.10828)\n# Patched in:     1.43.3.10861 (latest at time of writing: 1.43.4.10903)\n#\n# The script is strictly read-only. It needs some root access to read\n# native install logs \u2014 it will tell you if it skipped a check.\n#\n# Usage:\n#   bash plex-check.sh\n#\n# Exit codes:\n#   0 = no compromise indicators found\n#   1 = action needed (vulnerable version and/or compromise indicators)\n#   2 = Plex Media Server not detected\n#\nset -u\n\nFIX_MIN=1.43.3.10861   # first fixed build\nSELF=plex-check.sh\n\n# ---------------------------------------------------------------- output\nif [ -t 1 ] && [ -z \"${NO_COLOR:-}\" ]; then\n  C_G=$'\\033[32m'; C_Y=$'\\033[33m'; C_R=$'\\033[31m'; C_B=$'\\033[1m'; C_0=$'\\033[0m'\nelse\n  C_G=''; C_Y=''; C_R=''; C_B=''; C_0=''\nfi\n\nFAILS=0\nWARNS=0\nPASS ()  { printf '%s[PASS]%s  %s\\n' \"$C_G\" \"$C_0\" \"$*\"; }\nWARN ()  { printf '%s[WARN]%s  %s\\n' \"$C_Y\" \"$C_0\" \"$*\"; WARNS=$((WARNS+1)); }\nFAIL ()  { printf '%s[FAIL]%s  %s\\n' \"$C_R\" \"$C_0\" \"$*\"; FAILS=$((FAILS+1)); }\nSKIP ()  { printf '%s[SKIP]%s  %s\\n' \"$C_B\" \"$C_0\" \"$*\"; }\n\necho \"Plex Media Server compromise check (Plex2Shell, CVE-2026-96652/54/55/56)\"\necho \"Read-only. Nothing is modified. ${C_Y}Run with sudo for the deepest checks.${C_0}\"\necho\n\n# ---------------------------------------------------------------- utils\n# version >= threshold ?   Handles \"1.43.4.10903-e5521bd8c\" and 3-field versions.\nver_ge () {\n  local a=\"${1%%-*}\" b=\"${2%%-*}\"\n  local -a A B\n  IFS=. read -r -a A <<< \"$a\"\n  IFS=. read -r -a B <<< \"$b\"\n  local i x y\n  for i in 0 1 2 3; do\n    x=$((10#${A[i]:-0})); y=$((10#${B[i]:-0}))\n    if [ \"$x\" -gt \"$y\" ]; then return 0; fi\n    if [ \"$x\" -lt \"$y\" ]; then return 1; fi\n  done\n  return 0\n}\n\n\nRUN_ROOT () {  # try privileged, fall back to unprivileged\n  sudo -n \"$@\" 2>/dev/null || \"$@\" 2>/dev/null\n}\n\n# ------------------------------------------------------- 1) find the install\nINSTALLS=()           # strings: \"docker \" or \"native\"\nDOCKER=()\nNATIVE=0\n\nif command -v docker >/dev/null 2>&1; then\n  while IFS=$'\\t' read -r name image; do\n    if printf '%s %s' \"$name\" \"$image\" | grep -iq plex; then\n      DOCKER+=(\"$name\")\n    fi\n  done < <(docker ps --format '{{.Names}}\\t{{.Image}}' 2>/dev/null)\nfi\n\n# native install = package installed or systemd unit present\n# (do NOT use pgrep: host sees processes running inside containers)\nif dpkg -s plexmediaserver >/dev/null 2>&1 \\\n   || rpm -q plexmediaserver >/dev/null 2>&1 \\\n   || [ -f /lib/systemd/system/plexmediaserver.service ] \\\n   || [ -f /etc/systemd/system/plexmediaserver.service ]; then\n  NATIVE=1\nfi\n\nfor c in \"${DOCKER[@]}\";  do INSTALLS+=(\"docker $c\"); done\n[ \"$NATIVE\" -eq 1 ] && INSTALLS+=(\"native\")\n\nif [ ${#INSTALLS[@]} -eq 0 ]; then\n  echo \"${C_R}Plex Media Server not found (no plex container, service, or /var/lib/plexmediaserver).${C_0}\"\n  echo \"If Plex runs elsewhere, run this script on that machine.\"\n  exit 2\nfi\n\nprintf 'Detected install(s): %s\\n\\n' \"${INSTALLS[*]}\"\n\nVULNERABLE=0\nVERSION_UNKNOWN=0\n\nfor inst in \"${INSTALLS[@]}\"; do\n  kind=${inst%% *}\n  what=${inst#* }\n\n  echo \"${C_B}--- Checking: $inst ---${C_0}\"\n\n  # ------------------------------------------------------- 2) version\n  VER=\"\"\n  if [ \"$kind\" = docker ]; then\n    c=$what\n    VER=$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \"$c\" 2>/dev/null \\\n          | sed -n 's/^VERSION=//p' | head -n1)\n    if [ -z \"$VER\" ] && curl -sfm 5 http://127.0.0.1:32400/identity >/dev/null 2>&1; then\n      VER=$(curl -sfm 5 http://127.0.0.1:32400/identity | sed -n 's/.* version=\"\\([^\"]*\\)\".*/\\1/p' | tail -n1)\n    fi\n  else\n    VER=$(dpkg -s plexmediaserver 2>/dev/null | sed -n 's/^Version: *//p' | head -n1)\n    [ -z \"$VER\" ] && VER=$(rpm -q plexmediaserver 2>/dev/null | sed 's/^plexmediaserver-//')\n    if [ -z \"$VER\" ] && command -v curl >/dev/null 2>&1; then\n      VER=$(curl -sfm 5 http://127.0.0.1:32400/identity | sed -n 's/.* version=\"\\([^\"]*\\)\".*/\\1/p' | tail -n1)\n    fi\n  fi\n\n  if [ -n \"$VER\" ]; then\n    if ver_ge \"$VER\" \"$FIX_MIN\"; then\n      PASS \"Plex version $VER is patched (>= $FIX_MIN)\"\n    else\n      FAIL \"Plex version $VER is VULNERABLE (< $FIX_MIN) \u2014 the Plex2Shell chain is exploited in the wild. Upgrade now.\"\n      VULNERABLE=1\n    fi\n  else\n    WARN \"Could not determine Plex version. Check manually: Plex Web > Settings > General, or http://:32400/identity\"\n    VERSION_UNKNOWN=1\n  fi\n\n  if [ \"$kind\" = docker ]; then\n    c=$what\n\n    # ------------------------------------------------- 3) container processes\n    P=$(docker top \"$c\" aux 2>/dev/null || docker top \"$c\" -eo user,pid,comm 2>/dev/null)\n    if [ -n \"$P\" ]; then\n      if printf '%s\\n' \"$P\" | grep -aviE 'grep|plex-check' \\\n         | grep -aiE 'xmrig|myawesomeproxy|cryptonight|stratum\\+tcp|minerd|kdevtmpfsi|kinsing|/tmp/[a-z0-9]{6,}$' ; then\n        FAIL \"Suspicious process found in container $c (see line above)\"\n      else\n        PASS \"No miner/proxy processes in container $c\"\n      fi\n    else\n      SKIP \"Cannot list container processes (docker top failed)\"\n    fi\n\n    # ------------------------------------------------- 4) files in container\n    F=$(docker exec \"$c\" sh -c '\n        command -v find >/dev/null 2>&1 || { echo __NOFIND__; exit 0; }\n        find /tmp /var/tmp -maxdepth 2 \\( -iname \"*xmrig*\" -o -iname \"*miner*\" -o -iname \"*proxy*\" -o -name \"*.sh\" -o -name \"*.so\" \\) 2>/dev/null\n        for base in \"/var/lib/plexmediaserver/Library/Application Support/Plex Media Server\" \"/config/Library/Application Support/Plex Media Server\"; do\n          [ -d \"$base\" ] && find \"$base/Codecs\" -type f \\( -name \"*.so\" -o -name \"*.sh\" \\) 2>/dev/null\n        done' 2>/dev/null)\n    if [ -z \"$F\" ]; then\n      SKIP \"Cannot inspect container filesystem (find not available inside container)\"\n    elif printf '%s\\n' \"$F\" | grep -aq __NOFIND__; then\n      SKIP \"Cannot inspect container filesystem (find not available inside container)\"\n    else\n      SUS=$(printf '%s\\n' \"$F\" | grep -aiE 'xmrig|myawesomeproxy|miner|/tmp/.*\\.(sh|so)$')\n      SO=$(printf '%s\\n' \"$F\" | grep -ai '/Codecs/' | grep -aivE '/lib[a-z0-9_]*_(encoder|decoder)\\.(so|sh)$')\n      if [ -n \"$SUS\" ]; then\n        FAIL \"Suspicious files in container $c:\"\n        printf '       %s\\n' \"$SUS\"\n      else\n        PASS \"No suspicious files in /tmp, /var/tmp of container $c\"\n      fi\n      if [ -n \"$SO\" ]; then\n        WARN \"Files exist in the Codecs folder of container $c \u2014 review them (a known attack drops a malicious .so there):\"\n        printf '       %s\\n' \"$SO\"\n      else\n        PASS \"Codecs folder empty (no dropped libraries)\"\n      fi\n    fi\n\n    # ------------------------------------------------- 5) container network\n    N=$(docker exec \"$c\" sh -c 'command -v ss >/dev/null 2>&1 && ss -tunp state established' 2>/dev/null)\n    if [ -n \"$N\" ]; then\n      if printf '%s\\n' \"$N\" | grep -aE ':(3333|14444|14433|45700)\\b'; then\n        FAIL \"Container has established connections on a known mining port (line above)\"\n      else\n        PASS \"No connections to known mining ports from container $c\"\n      fi\n    else\n      SKIP \"Cannot check container network state (ss not available inside container)\"\n    fi\n\n    # ------------------------------------------------- 6) Plex access logs\n    L=$(docker logs \"$c\" --since 72h 2>&1 | grep -aiE 'transcode/universal\\?[^ ]*url=(https?|ftp|gopher)|GET /player/timeline\\?\\$|\\$X-Plex-Token|myawesomeproxy' | head -n 8)\n    if [ -n \"$L\" ]; then\n      FAIL \"Exploit signatures found in container logs of $c:\"\n      printf '       %s\\n' \"$L\"\n    else\n      PASS \"No exploit signatures in container logs (last 72h)\"\n    fi\n  fi\ndone\n\n# ---------------------------------------------------------------- native\nif [ \"$NATIVE\" -eq 1 ]; then\n  echo \"${C_B}--- Checking: native install ---${C_0}\"\n  DATA=\"/var/lib/plexmediaserver/Library/Application Support/Plex Media Server\"\n\n  P=$(ps aux 2>/dev/null)\n  if printf '%s\\n' \"$P\" | grep -aviE 'grep|plex-check' \\\n     | grep -aiE 'xmrig|myawesomeproxy|cryptonight|stratum\\+tcp|minerd|kdevtmpfsi|kinsing' \\\n     | grep -av 'Plex Plug-in'; then\n    FAIL \"Suspicious process found on host (see line above)\"\n  else\n    PASS \"No miner/proxy processes on host\"\n  fi\n\n  T=$(RUN_ROOT find /tmp /var/tmp -maxdepth 2 \\( -iname \"*xmrig*\" -o -iname \"*miner*\" -o -iname \"*proxy*\" -o -name \"*.so\" \\) 2>/dev/null)\n  if [ -n \"$T\" ]; then\n    FAIL \"Suspicious files in /tmp or /var/tmp:\"\n    printf '       %s\\n' \"$T\"\n  else\n    PASS \"No suspicious files in /tmp or /var/tmp\"\n  fi\n\n  N=$(ss -tunp state established 2>/dev/null | grep -aE ':(3333|14444|14433|45700)\\b' )\n  E=$(ss -tunp state established 2>/dev/null | grep -a 'users:((\"\\\"/tmp' )\n  if [ -n \"$N$E\" ]; then\n    FAIL \"Suspicious established connection(s) on host:\"\n    printf '       %s\\n' \"$N$E\"\n  else\n    PASS \"No connections to known mining ports, none running from /tmp\"\n  fi\n\n  LOG=\"$DATA/Logs/Plex Media Server.log\"\n  if RUN_ROOT test -f \"$LOG\"; then\n    L=$(RUN_ROOT grep -aiE 'transcode/universal\\?[^ ]*url=(https?|ftp|gopher)|GET /player/timeline\\?\\$|\\$X-Plex-Token|myawesomeproxy' \"$LOG\" 2>/dev/null | tail -n 8)\n    if [ -n \"$L\" ]; then\n      FAIL \"Exploit signatures found in native Plex logs:\"\n      printf '       %s\\n' \"$L\"\n    else\n      PASS \"No exploit signatures in native Plex logs\"\n    fi\n  else\n    SKIP \"Cannot read native Plex logs without root \u2014 for a deeper check run: sudo bash $SELF\"\n  fi\n\n  # ------------------------------------------------- simple persistence check\n  K=$(RUN_ROOT find /root/.ssh /home/*/.ssh -name authorized_keys -newermt '30 days ago' 2>/dev/null)\n  if [ -n \"$K\" ]; then\n    WARN \"authorized_keys modified in the last 30 days (check it is you):\"\n    printf '       %s\\n' \"$K\"\n  else\n    PASS \"No recently modified authorized_keys\"\n  fi\n  CR=$(RUN_ROOT grep -rlE 'curl|wget|/tmp/' /etc/cron.d /var/spool/cron/crontabs 2>/dev/null)\n  if [ -n \"$CR\" ]; then\n    WARN \"Cron entries reference curl/wget//tmp (check it is you):\"\n    printf '       %s\\n' \"$CR\"\n  else\n    PASS \"No suspicious cron entries\"\n  fi\nfi\n\n# ---------------------------------------------------------------- summary\necho\necho \"${C_B}============================== summary ==============================${C_0}\"\nif [ \"$VULNERABLE\" -eq 1 ]; then\n  echo \"${C_R}RESULT: FAIL \u2014 Plex is VULNERABLE to Plex2Shell. Upgrade immediately.${C_0}\"\nelif [ \"$VERSION_UNKNOWN\" -eq 1 ]; then\n  echo \"${C_Y}RESULT: UNKNOWN \u2014 could not confirm your Plex version. Check manually.${C_0}\"\nelif [ \"$FAILS\" -gt 0 ]; then\n  echo \"${C_R}RESULT: FAIL \u2014 $FAILS compromise indicator(s) found. Investigate. Do NOT:${C_0}\"\n  echo \"       delete evidence; isolate the machine first (unplug from network).\"\nelif [ \"$WARNS\" -gt 0 ]; then\n  echo \"${C_Y}RESULT: PASS with $WARNS item(s) to review manually (see WARN lines above).${C_0}\"\nelse\n  echo \"${C_G}RESULT: PASS \u2014 patched version, no compromise indicators found.${C_0}\"\nfi\necho\necho \"Remediation if anything is wrong:\"\necho \"  1. Upgrade Plex to >= $FIX_MIN (current latest: 1.43.4.10903)\"\necho \"  2. Disable Plex 'Remote Access' if you do not need it\"\necho \"  3. Rotate your plex.tv password and revoke/refresh the server token\"\necho \"  4. If any [FAIL] IOC above fired: isolate the machine and reinstall\"\necho \"     from scratch (docker: recreate container + delete its data dir)\"\n\nstay=0\nif [ \"$VULNERABLE\" -eq 1 ] || [ \"$VERSION_UNKNOWN\" -eq 1 ] || [ \"$FAILS\" -gt 0 ]; then\n  stay=1\nfi\nexit \"$stay\"\n", "url": "https://gist.github.com/gmolveau/b02c2e58b877cf138e2859dbfb5cc20e"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "timestamps.asserted_at", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96652", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": true, "value": "2026-10-20", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "evidence.0.details.date_added", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "timestamps.first_seen_at", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96652", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96652", "record": "FKIE_CVE-2026-96652", "field": "metrics.ssvcV203.1.ssvcData.timestamp"}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "status.status_updated_at", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96652", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-20T03:38:06Z", "date_only": false, "value": "2026-10-20T03:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "b5dfad9e-b196-4083-84f4-1cd758dda705", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T08:38:06Z", "date_only": false, "value": "2026-10-20T08:38:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "dfb23c45-c846-44b1-b2f1-1a94f51be0cc", "content": "Rilevato lo sfruttamento attivo in rete delle vulnerabilit\u00e0 CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 e CVE-2026-96656 - gi\u00e0 sanate dal vendor - relative a Plex Media Server. Si evidenzia che risulta disponibile in rete un Proof of Concept (PoC) per lo sfruttamento concatenato di tali vulnerabilit\u00e0.", "url": "https://www.acn.gov.it/portale/w/plex-media-server-rilevato-sfruttamento-in-rete-delle-catena-di-attacco-plex2shell"}, {"timestamp": "2026-10-20T11:24:16Z", "date_only": false, "value": "2026-10-20T11:24:16.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8732", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "31c673e3-6f88-4b96-a8d4-7d35f7709c7f", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 Plex2Shell, \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Plex Media Server, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC.\n\nCVE-2026-96652, CVE-2026-96654, CVE-2026-96655 \u0438 CVE-2026-96656 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u0435\u043c\u0438 \u0436\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u0447\u0442\u043e \u0438 \u0441\u043b\u0443\u0436\u0431\u0430 Plex.\n\n27 \u0438\u044e\u043b\u044f Plex \u0443\u0432\u0435\u0441\u0438\u043b\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0438\u0445 \u0438 4 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438. 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f Plex \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0439 Plex2Shell, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438 PoC 16 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b \u0430\u0442\u0430\u043a\u0443, \u0441\u043e\u0437\u0434\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0443 Plex \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0434\u043e 17 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u044d\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a. \u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0445\u043e\u0442\u044f, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0430\u0439\u043d\u0435\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 XMRig. \u041f\u043e\u0437\u0436\u0435 \u0432 \u0442\u043e\u0442 \u0436\u0435 \u0434\u0435\u043d\u044c \u043d\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c myawesomeproxy.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u043a\u0430\u043a \u043f\u0440\u043e\u043a\u0441\u0438-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443: \u043e\u043d\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u0435\u0451 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442, \u0441\u043e\u0433\u043b\u0430\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\n\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, Plex \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c IP, \u0438 \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u0443\u0434\u043e\u0432\u043e\u043b\u044c\u0441\u0442\u0432\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0431\u044b \u044d\u0442\u043e\u0442 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0439 \u0430\u0434\u0440\u0435\u0441 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c VPN \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c.\n\n\u041e\u043d \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b, \u0447\u0442\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 IOCs \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u0448\u044c \u0442\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0435.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u0441\u0442\u0430\u0442\u0438 Plex \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e.", "url": "https://t.me/true_secator/8732"}, {"timestamp": "2026-10-20T11:24:16Z", "date_only": false, "value": "2026-10-20T11:24:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8732", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "2e26e825-b1a9-45d4-8b3c-22509f6312b3", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 Plex2Shell, \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Plex Media Server, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC.\n\nCVE-2026-96652, CVE-2026-96654, CVE-2026-96655 \u0438 CVE-2026-96656 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0435\u0437 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041a\u043e\u0434 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \u0442\u0435\u043c\u0438 \u0436\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u0447\u0442\u043e \u0438 \u0441\u043b\u0443\u0436\u0431\u0430 Plex.\n\n27 \u0438\u044e\u043b\u044f Plex \u0443\u0432\u0435\u0441\u0438\u043b\u0438 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0438\u0445 \u0438 4 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0438\u043b\u0430 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438. 1 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f Plex \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0448\u0438\u0439 Plex2Shell, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438 PoC 16 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b \u0430\u0442\u0430\u043a\u0443, \u0441\u043e\u0437\u0434\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0443 Plex \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0434\u043e 17 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u044d\u0442\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0439 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0442\u0430\u043a. \u041f\u043e \u0441\u043b\u043e\u0432\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0445\u043e\u0442\u044f, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438 \u0432\u043d\u0435\u0441\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u0434.\n\n\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u043c\u0430\u0439\u043d\u0435\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 XMRig. \u041f\u043e\u0437\u0436\u0435 \u0432 \u0442\u043e\u0442 \u0436\u0435 \u0434\u0435\u043d\u044c \u043d\u0430 \u043b\u043e\u0432\u0443\u0448\u043a\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c myawesomeproxy.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u043a\u0430\u043a \u043f\u0440\u043e\u043a\u0441\u0438-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443: \u043e\u043d\u0430 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u0435\u0451 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442, \u0441\u043e\u0433\u043b\u0430\u0448\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430.\n\n\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, Plex \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c IP, \u0438 \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441 \u0443\u0434\u043e\u0432\u043e\u043b\u044c\u0441\u0442\u0432\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0431\u044b \u044d\u0442\u043e\u0442 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0439 \u0430\u0434\u0440\u0435\u0441 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u043c VPN \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u0435, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c.\n\n\u041e\u043d \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b, \u0447\u0442\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0435 IOCs \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043b\u0438\u0448\u044c \u0442\u0443 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0435.\n\n\u0412 \u0441\u0432\u043e\u0435\u043c \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u0441\u0442\u0430\u0442\u0438 Plex \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043d\u0435\u0437\u0430\u043c\u0435\u0434\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044e\u044e \u0432\u0435\u0440\u0441\u0438\u044e.", "url": "https://t.me/true_secator/8732"}, {"timestamp": "2026-10-20T12:00:01Z", "date_only": false, "value": "2026-10-20T12:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-96652", "field": "timestamps.recorded_at", "uuid": "09701585-1f99-469a-b808-29da06ab2361", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T12:00:58.179Z", "date_only": false, "value": "2026-10-20T12:00:58.179603Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/09701585-1f99-469a-b808-29da06ab2361", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "95877a7f-25b0-4df6-bb61-da957d106a0a", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/09701585-1f99-469a-b808-29da06ab2361"}, {"timestamp": "2026-10-20T12:30:38Z", "date_only": false, "value": "2026-10-20T12:30:38.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/44b72ac1-e095-4aee-ad97-df24053d6b2f", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "51dfe02b-a412-4f79-9a40-795ddce8e048"}, {"timestamp": "2026-10-20T20:00:01Z", "date_only": false, "value": "2026-10-20T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "timestamps.recorded_at", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-20T20:00:02.682Z", "date_only": false, "value": "2026-10-20T20:00:02.682189Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64c44cbc-dc1b-48f7-bb63-882c54e696dc", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "44ad633f-63b1-4b37-a8b6-e6e0c9612623", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/64c44cbc-dc1b-48f7-bb63-882c54e696dc"}, {"timestamp": "2026-10-20T21:30:35Z", "date_only": false, "value": "2026-10-20T21:30:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5P7W-R379-3C2M", "record": "GHSA-5P7W-R379-3C2M", "field": "modified"}, {"timestamp": "2026-10-20T23:00:56Z", "date_only": false, "value": "2026-10-20T23:00:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/45019", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "870f30cf-266f-4b5d-97eb-b1f524a3052e", "content": "CISA Adds Six Known Exploited Vulnerabilities to Catalog\n\nCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability\nCVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability\nCVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability\nCVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability \u00a0\nCVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability\nCVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/45019"}, {"timestamp": "2026-10-21T03:56:26.467Z", "date_only": false, "value": "2026-10-21T03:56:26.467Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96652", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T03:56:26.467Z", "date_only": false, "value": "2026-10-21T03:56:26.467Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96652", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T05:26:49Z", "date_only": false, "value": "2026-10-21T05:26:49.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "0f4b88b2-3074-4fe9-8d8e-a20cf2e7b195", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)", "url": "https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html"}, {"timestamp": "2026-10-21T13:09:44.770Z", "date_only": false, "value": "2026-10-21T13:09:44.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96652", "record": "FKIE_CVE-2026-96652", "field": "lastModified"}, {"timestamp": "2026-10-22T14:07:59Z", "date_only": false, "value": "2026-10-22T14:07:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/106586", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "e0492567-bd45-4e21-9e88-9056fae88e35", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a B63-POC-CVE-2026-96652\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a basesixtythree\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-22 14:00:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106586"}, {"timestamp": "2026-10-22T14:07:59Z", "date_only": false, "value": "2026-10-22T14:07:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/106586", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "88d0ad91-6977-4ffc-8e25-f9815bbe4317", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a B63-POC-CVE-2026-96652\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a basesixtythree\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-22 14:00:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC and verification material for CVE-2026-96652 (Plex Media Server timeline SSRF, owner-token disclosure chain)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106586"}, {"timestamp": "2026-10-26T08:27:42.149Z", "date_only": false, "value": "2026-10-26T08:27:42.149607Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3myrchbaray22", "record": "CVE-2026-96652", "field": "creation_timestamp", "uuid": "35776e03-306f-4421-bf46-39904fa16232", "content": "\ud83d\udd34 EXPLOITED\n\nFour Plex Media Server flaws chain into remote code execution with no login, all now flagged by CISA as exploited.\n\nInternet-facing Plex below build 1.43.3.10861 is the target, abused for crypto mining and proxying.\n\nPatch now. (CVE-2026-96652)", "url": "https://bsky.app/profile/suriq.io/post/3myrchbaray22"}, {"timestamp": "2026-11-03T00:00:00Z", "date_only": true, "value": "2026-11-03", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-96652", "field": "evidence.0.details.due_date", "uuid": "64c44cbc-dc1b-48f7-bb63-882c54e696dc", "status": {"status_reason": "confirmed", "exploited": true}}]}