CVE-2026-96652 · 96654 · 96655 · 96656Plex2Shell: is your Plex server affected?

npx wardlatch@latest --incident plex-2026-10

It reads the installed version from the Debian or Ubuntu package record (/var/lib/dpkg/status) and from the macOS app’s Info.plist, in /Applications and ~/Applications, and never runs Plex. It says EXPOSED (with the fix), SAFE, or UNKNOWN when a file couldn’t be read. It changes nothing and sends nothing.

By hand, on Debian or Ubuntu:

dpkg-query -W -f='${Status} ${Version}\n' plexmediaserver

On a Mac, in /Applications and ~/Applications:

for a in "/Applications/Plex Media Server.app" "$HOME/Applications/Plex Media Server.app"; do if [ -e "$a/Contents/Info.plist" ]; then printf '%s: ' "$a"; plutil -extract CFBundleShortVersionString raw "$a/Contents/Info.plist"; fi; done

On Fedora, Red Hat or CentOS, rpm -q plexmediaserver prints the installed package. For a NAS, Docker or Windows, use Plex Web’s Settings → General.

Fixed

1.43.3.10861 or later. The fourth number is the build; the package version may have more after a dash.

Update

Anything earlier, such as 1.43.2, or 1.43.3 with a build number below 10861.

Not installed

On Debian or Ubuntu: “no packages found”, or a status that ends in “not-installed” or “config-files”. On a Mac: no output. No Plex Media Server is installed that way on this machine.

Any other status

A status that ends in anything else, such as “installed”, “half-configured”, “unpacked”, “triggers-awaited” or “triggers-pending”: the server’s files are there, so compare the version as above. Wardlatch counts all of these as installed.

1. Update Plex Media Server to 1.43.3.10861 or later.
2. Look for signs of compromise if the server was reachable from the internet while unpatched: processes the server started that you don’t recognise, unfamiliar library files in its Codecs folder, outbound connections you don’t expect, and high CPU use when nothing is playing.
3. If you find any, or can’t rule it out, rebuild from a clean install rather than reusing the old data folder. Clear the Codecs folder, review the transcoder settings in Preferences.xml, sign out of all devices, change your Plex password, and treat any shares or credentials the server’s account could reach as exposed.
4. Can’t update right now? Turn off Remote Access (Settings → Remote Access) if you don’t need it, and don’t forward port 32400 straight to the internet.
5. Check again with the commands in section A.

• Two kinds of install. Wardlatch reads the Debian package record and the macOS app. rpm, Snap, NAS and Docker installs aren’t checked yet, and Windows is not supported.
• Version only. It tells you whether the server is patched, not whether it was broken into before. That takes the checks in section C.
• This machine only. Run it on the machine that runs the server.

This page describes Wardlatch 0.1.9 and its incident file, plex-2026-10.json.

1. Plex, important security update for Plex Media Server v1.43.2 and earlier, posted 2026-09-01, updated 2026-10-19: the four CVEs; fixed in 1.43.3.10861; actively and widely exploited since a public proof of concept on 2026-10-16; how to check the version; signs of compromise, clean-up and what to do until you can update.
2. Wardlatch 0.1.9, plex-2026-10.json and README: the files it reads, and the package statuses it counts as installed.
3. CISA, Known Exploited Vulnerabilities catalog: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, each added on 2026-10-20.

Credits · Plex’s notice doesn’t name who reported the flaws. All sources read 2026-10-25.