A flaw in older Plex Media Server versions is being used to take over servers. What it is, whether StreamBridge is affected, and what to do.
Plex2Shell is a chain of four flaws in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). Linked together, they let someone who can reach your server take it over without a password. They can steal the token Plex uses to prove you're the owner, then run their own programs on the computer Plex is on.
Plex fixed the flaws in version 1.43.3.10861, weeks before full details were published on October 16. Attacks began the next day. Servers that were taken over have been found running crypto miners and proxy software. Some have been used to flood other people's networks, which can also slow your own internet to a crawl.
No. The flaw is in Plex Media Server, not StreamBridge. StreamBridge talks to Plex only on your own Mac, and its file server can't be reached from other computers. It doesn't need Remote Access or a router port forward to work, and it doesn't open any.
But StreamBridge relies on your Plex Media Server, so if that server is out of date, your Mac is exposed.
Update Plex Media Server. In Finder, open Applications, select Plex Media Server and choose File › Get Info. Version 1.43.4 or later is fixed. If it's older, or says 1.43.3, get the latest from plex.tv.
Don't expose Plex to the whole internet unless you need to. If you set up a port forward to 32400 on your router and don't use Plex away from home, remove it. You can also turn off Remote Access in Plex's settings.
Turn on the macOS firewall in System Settings › Network › Firewall.
If your server was out of date and reachable from the internet, change your Plex password. Then choose Sign out of all devices on your Plex account page. That makes any stolen token useless.
Sign StreamBridge back in. After you sign out of all devices, StreamBridge shows "Plex signed you out, so new titles can't reach it." Choose Sign In Again… in Settings › Connection. Your library and settings stay as they are.
Look for your Mac's fans running hard or your upload maxed out when nothing is playing, processes you don't recognize running under Plex in Activity Monitor, or unfamiliar hidden files in /tmp or /var/tmp. If you find any of these, update Plex, change your password as above, and restart your Mac.
Questions? Write to hello@streambridgeforplex.com.