Threat Actors Exploit Plex2Shell Chain to Install Crypto Miners and Backdoors
Attackers are chaining four Plex Media Server flaws to deploy cryptocurrency miners and a Linux proxy backdoor, according to new security research.
Key points
- The Plex2Shell chain combines four vulnerabilities to achieve unauthenticated remote code execution on affected servers.
- Exploitation was observed one day after proof-of-concept details were published on October 16, 2026.
- The attacks deploy cryptocurrency miners and a stealthy backdoor named myawesomeproxy on compromised systems.
Threat actors are actively exploiting a sequence of four vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy software, according to reporting by The Hacker News. This exploitation activity began one day after technical details of the attack chain, known as Plex2Shell, were made public on October 16, 2026. The attacks target unpatched instances of the media server software.
Security researcher boredhackerblog documented the exploitation campaign, which links four distinct flaws to achieve unauthenticated remote code execution. The attackers use this access to download and run malicious payloads, including a miner sourced from a remote server and a Linux backdoor. These actions compromise the integrity and security of the affected media server infrastructure.
Technical Details of the Vulnerability Chain
The Plex2Shell chain relies on chaining CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The first flaw, CVE-2026-96652, is an unauthenticated server-side request forgery with a CVSS score of 5.3. It allows attackers to force the server to send POST requests to arbitrary destinations by manipulating the protocol parameter in the player timeline endpoint.
The second vulnerability, CVE-2026-96654, scores 6.9 and involves improper neutralization of URL values in the searchOne endpoint. This flaw enables attackers to invoke other plugins’ functions and supply custom parameters to extract the server owner’s admin token, which is necessary for the subsequent steps in the chain.
Using the stolen admin token, attackers exploit CVE-2026-96655, another SSRF flaw scoring 5.3. This vulnerability allows authenticated users to request arbitrary internal or external addresses via the transcode path. Attackers use this to fetch malicious ELF payloads hosted on external servers, preparing the environment for code execution.
The final step involves CVE-2026-96656, a high-severity flaw with a CVSS score of 8.6. This external control of file name vulnerability allows the attacker to redirect the ELF shared object to a chosen path within the Codecs directory. This action results in the execution of the malicious code, completing the remote code execution chain.
Impact and Background Information
The vulnerabilities were originally disclosed to Plex by security researcher Zach Main on July 27, 2026. Main also reported CVE-2026-96651, which has a CVSS score of 7.1. Plex addressed these issues by releasing version 1.43.3.10861 on August 3, 2026, which included patches for all identified flaws.
Despite the availability of the fix, exploitation attempts were recorded on October 17, 2026, following the publication of the proof-of-concept. The attacks resulted in the deployment of a cryptocurrency miner from the IP address 217.60.194[.]116. Additionally, the malware includes an artifact named myawesomeproxy, which VirusTotal identifies as a stealthy Linux backdoor and reverse proxy.
What should you do?
Administrators should verify that their Plex Media Server instances are running version 1.43.3.10861 or later to ensure they are protected against the Plex2Shell chain. Organizations should monitor their servers for unexpected outbound connections to known malicious IPs or unusual resource usage indicative of cryptocurrency mining. Security teams should also scan for the presence of the myawesomeproxy backdoor in their Linux environments.
What to do and how to stay safe: Plex Media Server
- Update all Plex Media Server installations to version 1.43.3.10861 or the latest available release immediately.
- Monitor network traffic for connections to the IP address 217.60.194[.]116 or other suspicious external endpoints.
- Scan Linux systems for the presence of the myawesomeproxy binary or unexpected ELF files in the Codecs directory.
- Review server logs for unauthorized access attempts to the player timeline or searchOne endpoints.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Plex2Shell?
Plex2Shell is a chain of four vulnerabilities in Plex Media Server that allows attackers to achieve unauthenticated remote code execution.
When were these vulnerabilities patched?
The vulnerabilities were patched in Plex Media Server version 1.43.3.10861, which was released on August 3, 2026.
What malware is being deployed via this exploit?
Attackers are deploying cryptocurrency miners and a Linux backdoor named myawesomeproxy on compromised systems.
