Check if plex installation is hacked #plex2shell

Is my Plex server hacked?

A one-file, read-only script (plex-check.sh) you can run on any server to check whether a Plex Media Server install shows signs of compromise via the Plex2Shell exploit chain and the malware dropped by it in the wild.

Background: what is Plex2Shell?

In October 2026, a chain of four Plex Media Server bugs was published with a working PoC (CVE-2026-96652, -96654, -96655, -96656). Chained together, they allow unauthenticated remote code execution on any exposed Plex server running:

Plex Media Server < 1.43.3.10861      (including 1.43.3.10828!)

Exploitation began in the wild on Oct 17, 2026 — two days after the PoC went public — dropping an XMRig Monero miner and a residential proxy called myawesomeproxy.

Patched build: 1.43.3.10861 (current latest: 1.43.4.10903).

What the script checks

All checks are strictly read-only — nothing is modified on your machine.

Checks it cannot perform are reported as [SKIP] with an explanation — they require root (run sudo bash plex-check.sh) or are unavailable inside a container.

How to run

Copy the script onto the machine running Plex, then:

bash plex-check.sh

For the deepest checks (native Plex logs, root-owned folders, cron):

sudo bash plex-check.sh

Requirements: bash, GNU find/grep/sed. Linux is the target platform; on other platforms it degrades to fewer (or [SKIP]ed) checks.

Exit codes (useful for automation)

Reading the output

• [PASS] — check confirmed clean.
• [WARN] — something exists that could be an indicator but is often legitimate (recently changed authorized_keys, cron entries that use curl, …). Look at them and confirm they are yours.
• [FAIL] — either your Plex version is vulnerable, or a known compromise indicator was found. Act on it.
• [SKIP] — the check could not run in this environment.

What to do if a check fails

Vulnerable version but no [FAIL] IOCs:

1. Upgrade Plex to ≥ 1.43.3.10861 immediately (latest release is best).
2. Disable Settings → Remote Access if you don't need it.
3. Change your plex.tv password (Plex suffered a data breach in 2022).

Any [FAIL] IOC fired (processes, files, network, logs):

1. Isolate the machine from the network first — do not delete evidence yet.
2. Assume the plex.tv token and any credentials the Plex user could reach are stolen. Rotate them from a clean machine.
3. Reinstall from scratch:
   • Docker: delete the container and its data volume/directory, pull a fresh image, recreate.
   • Native: back up your media (not the config), wipe the OS or at least the plex data dir + user, reinstall current Plex.
4. If the same machine holds other services (SSH keys, VPN configs…), audit those too — the exploit runs as the plex user, but drop more payload once inside.

False positives to expect

• The Codecs folder legitimately contains standard Plex codec libraries named lib*_decoder.so / lib*_encoder.so — those are filtered out; only unexpected names are flagged.
• authorized_keys/cron WARNs assume attackers like persistence, but you probably also touched your own keys recently — that's fine.

For the paranoid / manual verification

# exact version
curl -s http://SERVER_IP:32400/identity | grep version=

# what's inside the container
docker top 

# exploit signatures in the last 3 days of logs
docker logs  --since 72h 2>&1 \
  | grep -iE 'transcode/universal\?[^ ]*url=(https?|ftp|gopher)|myawesomeproxy'