Wild Exploits Target Plex Servers to Deploy Cryptominers and Proxy Tools
Researchers confirm active abuse of a public exploit chain against exposed Plex Media Server installations, resulting in unauthorized code execution and malware deployment.
Key points
- Attackers used the public Plex2Shell exploit to breach honeypots on October 17, 2026.
- The malware payload included an XMRig cryptominer and a proxy tool named myawesomeproxy.
- Plex released security updates in September 2026 to address the four chained vulnerabilities.
Researchers documented successful attacks against a Plex Media Server honeypot on October 17, 2026. According to Cyber Security News, these intrusions utilized the publicly available Plex2Shell exploit to install cryptocurrency mining software and additional proxy utilities on the compromised system.
The exploit chain combines four distinct vulnerabilities to execute code without requiring valid login credentials. Boredhackerblog reported that the attacks targeted a Linux-based Plex deployment running inside Docker containers. The activity demonstrated real-world exploitation rather than simple vulnerability scanning, though the exact number of affected production servers remains unknown.
Exploit Mechanics and Payloads
The Plex2Shell repository details how the attack leverages CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The process begins with server-side request forgery, tricking the server into sending attacker-controlled requests to internal functions. This grants access to owner-authorized actions, allowing the writing of files to specific locations.
The final stage abuses the loading of an unsigned codec to run arbitrary code. The repository identifies Plex versions prior to 1.43.3.10828 as vulnerable. While the exploit supports both Linux and Windows, the observed honeypot attacks targeted Linux environments. Version 1.43.3.10861 is listed as the fixed release in the exploit documentation.
Attack Observations and Indicators
The researcher recorded initial exploitation attempts originating from IP address 45.194.92[.]222. Subsequent activity came from 91.92.40[.]202 and 176.65.139[.]228. These requests targeted the /player/timeline/subscribe endpoint and included references to internal Plex services, an sslip.io hostname, and a Python-urllib/3.10 user agent string.
After enabling outbound traffic for monitoring, the researcher observed downloads from 217.60.194[.]116. The transferred files were named docker and x. Analysis of these artifacts revealed packed and unpacked samples, ultimately delivering an XMRig miner. A later update noted a process called myawesomeproxy and traffic associated with proxystream[.]st.
Vendor Response and Scope
Plex announced security updates on September 1, 2026, urging users to install Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company’s security notice warned that users of Network Attached Storage (NAS) devices might need to apply these updates manually. This guidance addresses the vulnerabilities chained in the Plex2Shell exploit.
Cyber Security News previously covered the release of these security updates and the affected software versions. The current reports focus on the active exploitation of these flaws in the wild. The evidence does not identify the specific threat actors responsible for the October 17 attacks.
What should you do?
Security teams should verify that all Plex Media Server installations are running version 1.43.3.10861 or later. Administrators must check for unauthorized processes such as XMRig or unknown proxy tools on their servers. Monitoring outbound traffic for connections to suspicious domains can help detect early-stage compromises. Users should ensure their servers are not exposed to the public internet without proper authentication and access controls.
What to do and how to stay safe: Plex
- Audit all Plex Media Server installations to ensure they are updated to version 1.43.3.10861 or newer.
- Review server logs for requests to /player/timeline/subscribe containing unusual user agents or internal hostnames.
- Monitor outbound network traffic for connections to unknown IP addresses or domains like sslip.io.
- Check running processes for unauthorized executables named docker, x, or myawesomeproxy.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerabilities does Plex2Shell exploit?
The exploit chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to achieve remote code execution.
Which Plex versions are affected by this exploit?
Versions before 1.43.3.10828 are vulnerable, with 1.43.3.10861 identified as the fixed version in the exploit repository.
Is there evidence of widespread real-world compromise?
Researchers confirmed successful attacks on a honeypot, but available evidence does not establish how many actual production servers have been compromised.
