Hackers Exploit Plex Media Server Vulnerabilities to Deploy Cryptominer Malware
Multiple vulnerabilities in Plex Media Server, chained as Plex2Shell, are being actively exploited in the wild to deploy cryptominer malware and proxy software.
Threat actors are actively exploiting a chain of vulnerabilities in Plex Media Server, collectively known as Plex2Shell, to deploy cryptominer malware and other malicious software. Researchers observed exploitation attempts against a honeypot on October 17, 2026, indicating that the public exploit is not just being tested but actively used for malicious purposes. While the exact number of compromised servers remains unknown, the activity highlights a significant risk for users running vulnerable versions of the popular media server software.
Plex released security updates on September 1, 2026, urging users to install Plex Media Server version 1.43.3 and Plex Desktop version 1.115.0. The company specifically noted that Network Attached Storage (NAS) users might need to perform manual updates. The Plex2Shell exploit leverages a combination of four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These vulnerabilities allow attackers to achieve remote code execution without requiring authentication.
The exploit chain begins with a server-side request forgery (SSRF) vulnerability, which tricks the Plex server into making requests on behalf of the attacker. This is followed by the exploitation of internal functions to gain access to owner-authorized requests. The attackers then leverage these privileges to write a file to a location of their choosing on the server. The final stage involves abusing the loading of an unsigned codec to execute arbitrary code on the compromised system.
According to the Plex2Shell repository, versions of Plex Media Server prior to 1.43.3.10828 are vulnerable, with version 1.43.3.10861 listed as fixed. While the exploit is capable of targeting both Linux and Windows systems, the observed honeypot activity involved a Linux-based Plex deployment running within a Docker container. This suggests that containerized environments, often used for media servers, are also at risk.
Initial observations of the honeypot revealed exploitation attempts originating from several IP addresses, including 45.194.92[.]222, 91.92.40[.]202, and 176.65.139[.]228. These attempts targeted the /player/timeline/subscribe endpoint and included suspicious references to internal Plex services and a Python-urllib user agent. After the researcher enabled outbound traffic logging, the honeypot downloaded files from 217.60.194[.]116, including what appeared to be a packed XMRig cryptominer and a proxy tool named 'myawesomeproxy' associated with proxystream[.]st.
The deployment of XMRig miners is a common tactic used by threat actors to leverage compromised systems for cryptocurrency mining, generating illicit profits. The presence of proxy software alongside the miner raises further concerns, as it could be used to obfuscate the origin of malicious traffic or to facilitate other illicit activities, such as distributed denial-of-service (DDoS) attacks or acting as a pivot point for further network intrusion.
While the current evidence does not definitively attribute this campaign to a specific threat actor or botnet, the observed techniques are consistent with financially motivated cybercrime. Administrators are strongly advised to update their Plex Media Server installations immediately, especially those running on NAS devices or within Docker environments. Security teams should monitor their systems for unusual processes, suspicious network connections, and unexpected file downloads, particularly those related to mining or proxying software.