Researchers confirm active exploitation of patched Plex Media Server vulnerabilities

Attackers are actively exploiting a chain of four vulnerabilities in the Plex Media Server to install malware on unpatched systems, according to a security researcher. The attacks result in remote code execution, allowing threat actors to take full control of the compromised devices.

The exploit chain, which the researcher named “Plex2Shell,” was revealed last week. It allows attackers to execute arbitrary code on devices running vulnerable versions of the media server. The proof-of-concept was part of a bug report submitted to Plex, demonstrating how multiple flaws can be combined for significant impact.

Exploit mechanics and payloads

The “Plex2Shell” chain performs a series of complex steps to compromise a system. These steps include an unauthenticated server-side request forgery, a loopback pivot, security token theft, payload delivery, and final execution. The researcher stated that artificial intelligence was used heavily during the development process, though the overall strategy and judgment calls were manual.

A separate researcher created a honeypot to track attempts to exploit this chain in the wild. Within one day of deployment, the honeypot recorded active scanning of the simulated Plex server. Successful exploitation attempts were also observed, confirming that the vulnerability chain is being used in real-world attacks.

Malware objectives and severity

Successful attacks are currently installing two specific types of malware payloads on compromised devices. One payload is a cryptominer that uses the victim’s computing resources to mine cryptocurrency. The mined coins are deposited into a wallet controlled by the attacker, generating illicit revenue from the stolen processing power.

The second payload is residential proxy software. This application allows attackers to anonymize their internet traffic by routing it through the infected device. According to Ars Technica, the researcher noted that threat actors likely seek residential IP addresses to access corporate VPNs and email systems, leveraging the perceived trustworthiness of home networks.

Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities in total. One of these carries a severity rating of 8.6 out of a possible 10, indicating a high level of risk for unpatched systems.

Who is affected

Users running unpatched versions of the Plex Media Server are the primary targets of this campaign. The attacks specifically target systems that have not yet applied the fixes released at the beginning of last month. Any device hosting Plex on a residential IP address may be particularly attractive to attackers seeking proxy infrastructure.

The researcher emphasized that the exploit development involved hours of iterative work, dead ends, and reprioritization. The AI tool was not simply instructed to hack Plex; rather, it assisted in breaking the system into logical components and mapping paths from user input to dangerous sinks.

What should you do?

Administrators and users should verify that their Plex Media Server installations are updated to the latest version. This ensures that the four vulnerabilities fixed at the start of last month are patched. Failure to update leaves systems vulnerable to remote code execution via the “Plex2Shell” chain.

Background: Token theft

Revoke the compromised token immediately. Terminate all active sessions for the affected identity. Rotate associated API keys and secrets. Audit recent actions for data exfiltration. Reset multi-factor authentication bindings. Monitor logs for anomalous behavior from related accounts to detect lateral movement.

Read the full guide: Token Theft Response: Containment, Revocation, and Recovery Steps

What to do and how to stay safe: Plex Media Server

• Update Plex Media Server to the latest version immediately to apply recent security patches.
• Monitor network traffic for unusual outbound connections that may indicate cryptomining or proxy usage.
• Restrict external access to the Plex server port unless remote access is explicitly required.
• Enable two-factor authentication on Plex accounts to reduce the risk of credential-based attacks.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating of the highest-rated vulnerability in this group?

One of the five published vulnerabilities carries a severity rating of 8.6 out of 10.

What types of malware are being installed by these attackers?

Attackers are installing cryptominers and residential proxy software on compromised devices.

How did the researcher develop the exploit chain?

The researcher used AI heavily for component mapping and verification but made all strategic judgment calls manually.