Plex2Shell Attacks: Hackers Drop Crypto Miners and a Proxy Backdoor on Plex Servers

Attackers have started exploiting a chain of vulnerabilities in Plex Media Server, planting cryptocurrency miners and reverse proxy software on compromised instances. The activity began just a day after a proof-of-concept (PoC) was published.

According to a researcher using the alias boredhackerblog, the attack chains together four flaws collectively named Plex2Shell.

A chain of four flaws

The first bug, CVE-2026-96652 (CVSS 5.3), is an unauthenticated SSRF in the /player/timeline endpoint: the protocol parameter is dropped into a constructed player URL without validation, letting an attacker force the server to POST to an address of their choosing. The second, CVE-2026-96654 (CVSS 6.9), stems from improper handling of URLs in the searchOne endpoint, allowing an attacker to call other plugins' functions and obtain the owner's admin token.

The third, CVE-2026-96655 (CVSS 5.3), is another SSRF — this time authenticated: with the owner token, an attacker can reach arbitrary internal or external addresses via the /video/:/transcode/universal path parameter, including pulling a malicious ELF payload. Finally, CVE-2026-96656 (CVSS 8.6) lets the attacker place a shared ELF object at a chosen path in the Codecs directory and run it.

Stacked in that order, the flaws yield unauthenticated remote code execution.

A patch was already available

The vulnerabilities — along with CVE-2026-96651 (CVSS 7.1) — were disclosed to Plex by researcher Zach Main on July 27, 2026, and fixed in Plex Media Server 1.43.3.10861, released August 3. Technical details of the chain went public on October 16; the first in-the-wild attacks appeared a day later.

Malware with cheerful names

Attackers pulled a miner from the remote server 217.60.194[.]116. Among the artifacts is myawesomeproxy, which VirusTotal flags as a stealthy Linux backdoor and reverse proxy. On launch, the program displays an almost taunting notice: running it means you agree to the potential external use of your internet traffic.

Deployed alongside it is an XMRig miner dubbed mylovelyminer, pointing at ota.proxystream[.]st. A sibling subdomain of the same domain was linked by Bitsight in August to the AISURU DDoS and proxyware botnet. Reddit users have reported infections with the same mylovelyminer payload, though a direct tie to Plex2Shell is not yet confirmed.

Plex had already urged users to update more than a month ago. In light of active exploitation, keeping installations current is strongly advised.

Source: The Hacker News