Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners on Media Servers
A chain of four vulnerabilities, dubbed Plex2Shell, is being actively exploited to gain unauthenticated remote code execution on Plex Media Servers, leading to the deployment of cryptocurrency miners.
Cybercriminals are actively exploiting a newly disclosed vulnerability chain, known as Plex2Shell, to compromise Plex Media Servers and deploy malicious cryptocurrency mining software. The attacks began shortly after public exploit code became available, indicating a rapid weaponization of the discovered flaws. The Plex2Shell chain comprises four distinct vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Together, these flaws allow an unauthenticated remote attacker to execute arbitrary code on the targeted server with the same privileges as the Plex service itself.
The exploitation chain begins with a server-side request forgery (SSRF) vulnerability within the /player/timeline endpoint. This flaw allows an attacker to trick the Plex Media Server into making requests to arbitrary URLs, including those controlled by the attacker. The server's trust in its own internal requests is then leveraged to bypass authentication mechanisms. By manipulating requests to a plugin interface, attackers can ultimately gain access to sensitive administrative tokens.
With these administrative tokens in hand, attackers can modify Plex Media Server's configuration. Specifically, they can alter transcoder settings to write malicious executable files disguised within video files into the server's codec folder. When the Plex Media Server subsequently transcodes a video, it loads and executes this malicious file, effectively granting the attacker persistent control over the compromised system.
Security researcher Zach Main discovered and reported these vulnerabilities to Plex on July 27, with Plex confirming the report and issuing a bug bounty on August 4. The proof-of-concept exploit code and detailed write-up were subsequently published on GitHub, paving the way for widespread exploitation.
Within a day of the exploit code's public release, a researcher monitoring a honeypot observed the first real-world exploitation attempts. The attackers were observed deploying XMRig-based Monero miners and a Linux proxy tool named "myawesomeproxy." Evidence suggests the mining payloads were connected to the AISURU botnet, indicating a coordinated effort.
The widespread use of Plex Media Server, often exposed directly to the internet on port 32400 for remote streaming, makes it an attractive target. The exploitation is not limited to home users, with reports indicating that some Network Attached Storage (NAS) devices, such as QNAP systems, have also been compromised.
In response to the escalating threat, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added all four Plex2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Users are strongly urged to update their Plex Media Server installations to version 1.43.3.10861 or newer. However, updating alone will not remove any already installed malicious payloads, necessitating a thorough security audit and potential clean reinstallation for compromised systems.
QNAP advises users to treat any exposed server as potentially compromised, check for signs of infection, perform a clean reinstall, and reset all credentials. For those who do not require remote access, disabling port forwarding for port 32400 is recommended. If remote access is necessary, utilizing a VPN is a more secure alternative. Administrators should also monitor Plex processes for unusual child processes, unexpected downloads, and elevated CPU usage, as these can be indicators of cryptojacking activity.