Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.
According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.
The vulnerabilities are below -
- CVE-2026-96652 (CVSS score: 5.3) - An unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint by taking advantage of the fact that the "protocol" parameter is inserted into a programmatically-constructed player URL with no validation, allowing an attacker to force the Plex server to POST to a destination of their choice.
- CVE-2026-96654 (CVSS score: 6.9) - An improper neutralization of URL values included in the "searchOne" endpoint that could allow an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token.
- CVE-2026-96655 (CVSS score: 5.3) - An SSRF vulnerability that allows an authenticated user (i.e., the owner token) to request arbitrary internal or external addresses (e.g., an attacker-hosted carrier video carrying the malicious ELF payload) via the '/video/:/transcode/universal' path parameter.
- CVE-2026-96656 (CVSS score: 8.6) - An external control of file name or path vulnerability that allows the ELF shared object to an attacker-chosen path in the Codecs directory and execute it.
Put differently, the vulnerabilities can be combined together in this order to achieve unauthenticated remote code execution on susceptible Plex Media Server instances.
The vulnerabilities, along with CVE-2026-96651 (CVSS score: 7.1), were disclosed to Plex on July 27, 2026, by security researcher Zach Main, and were patched in Plex Media Server 1.43.3.10861 released on August 3, 2026.
In-the-wild exploitation attempts targeting the flaws have since been recorded a day after technical details of the Plex2Shell chain went public on October 16, 2026. The attacks led to the deployment of a miner payload from a remote server ("217.60.194[.]116").
The attack efforts have been observed from the following IP addresses -
- 91.92.40[.]202
- 176.65.139[.]228
- 45.194.92[.]222
- 176.65.139[.]228
Furthermore, the vulnerabilities have been exploited to deliver an artifact named "myawesomeproxy," which, according to VirusTotal, is a stealthy Linux backdoor and reverse proxy. Running the program displays the below message, per boredhackerblog -
Running this software on any of your devices makes you agree to the potential external use of your internet traffic.
Also deployed concurrently is an XMRig miner process identified as "mylovelyminer" with its mining server pointing to "ota.proxystream[.]st." Notably, another subdomain associated with the same domain, "global.relay.proxystream[.]st," was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet.
Posts on Reddit indicate that multiple Plex users have had their instances compromised with the same "mylovelyminer" payload. That said, it's not known at this stage if it stems from the exploitation of Plex2Shell flaws.
The development comes more than a month after Plex urged users to update their instances to the latest version following the release of an update that addressed multiple unspecified security flaws.
It's unclear if the aforementioned vulnerabilities were part of this alert. The Hacker News has contacted Plex for comment and we will update the story if we hear back. In light of active exploitation, users are advised to keep their Plex installations up-to-date for optimal protection.
