[plex]

October 19, 2026

• A public Plex2Shell chain turns four Plex flaws into unauthenticated RCE. The exploit repository combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 through SSRF, a loopback authorization pivot and arbitrary file write, ending in unsigned-codec loading. It identifies <1.43.3.10828 as the target range and 1.43.3.10861 as fixed; Plex’s advisory carries vendor guidance. Publication of the exploit does not by itself establish active exploitation. · Vulnerabilities & Offensive Research

in AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts