Plex2Shell Attacks Began One Day After Exploit Release
Attackers targeted internet-facing Plex Media Servers on Oct. 17, one day after a researcher published Plex2Shell details and proof-of-concept code.
Attackers used the Plex2Shell exploit chain against internet-facing Plex Media Servers on Oct. 17, one day after a researcher published technical details and working proof-of-concept code. The attacks installed an XMRig cryptocurrency miner and proxy software on vulnerable systems.
The chain combines four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The flaws can allow attackers to run arbitrary code on an exposed Plex server without valid credentials. The code runs with the privileges assigned to the Plex service.
A researcher detected the activity with an internet-facing honeypot running a vulnerable version of Plex Media Server. Before Oct. 17, the decoy server had mainly received reconnaissance scans and generic attack attempts. “As of this morning (Oct 17th), I finally saw in the wild exploitation,” the researcher wrote.
The attackers appeared to use the publicly released exploit, although they may have modified the code. Their initial payload included XMRig, software commonly used to mine Monero. Later on Oct. 17, the honeypot received a second program called myawesomeproxy.
The researcher identified myawesomeproxy as proxy software. A notice displayed by the program says that users who run it agree to the potential use of their internet traffic. The researcher wrote that attackers might seek residential IP addresses because Plex servers can run on home networks. Those addresses could then be used to try to reach corporate virtual private networks and email systems.
The indicators of compromise published by the researcher cover only the activity observed on the honeypot. Other attackers may use different payloads, infrastructure or modified versions of the exploit.
The Plex2Shell vulnerabilities were reported to Plex on July 27. The company confirmed the findings and awarded a bug bounty on Aug. 4. Plex announced on Sept. 1 that it had shipped fixes and urged server owners to install the newest release without delay.
Articles by this author
