Risk actors have begun to take advantage of a series of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software program, a day after a proof-of-concept (PoC) went public.
In keeping with a researcher who goes by the net alias boredhackerblog, the exploitation exercise entails chaining 4 totally different vulnerabilities, collectively referred to as Plex2Shell.
The vulnerabilities are under –
- CVE-2026-96652 (CVSS rating: 5.3) – An unauthenticated server-side request forgery (SSRF) stemming by way of the “/participant/timeline” endpoint by making the most of the truth that the “protocol” parameter is inserted right into a programmatically-constructed participant URL with no validation, permitting an attacker to drive the Plex server to POST to a vacation spot of their selection.
- CVE-2026-96654 (CVSS rating: 6.9) – An improper neutralization of URL values included within the “searchOne” endpoint that might permit an attacker to name different plugins’ capabilities and provide their very own parameters to acquire the proprietor’s admin token.
- CVE-2026-96655 (CVSS rating: 5.3) – An SSRF vulnerability that enables an authenticated consumer (i.e., the proprietor token) to request arbitrary inside or exterior addresses (e.g., an attacker-hosted provider video carrying the malicious ELF payload) by way of the ‘/video/:/transcode/common’ path parameter.
- CVE-2026-96656 (CVSS rating: 8.6) – An exterior management of file title or path vulnerability that enables the ELF shared object to an attacker-chosen path within the Codecs listing and execute it.
Put in another way, the vulnerabilities will be mixed collectively on this order to attain unauthenticated distant code execution on prone Plex Media Server situations.
The vulnerabilities, together with CVE-2026-96651 (CVSS rating: 7.1), had been disclosed to Plex on July 27, 2026, by safety researcher Zach Most important, and had been patched in Plex Media Server 1.43.3.10861 launched on August 3, 2026.
In-the-wild exploitation makes an attempt concentrating on the issues have since been recorded a day after technical particulars of the Plex2Shell chain went public on October 16, 2026. The assaults led to the deployment of a miner payload from a distant server (“217.60.194[.]116”).
The assault efforts have been noticed from the next IP addresses –
- 91.92.40[.]202
- 176.65.139[.]228
- 45.194.92[.]222
- 176.65.139[.]228
Moreover, the vulnerabilities have been exploited to ship an artifact named “myawesomeproxy,” which, based on VirusTotal, is a stealthy Linux backdoor and reverse proxy. Operating this system shows the under message, per boredhackerblog –
Operating this software program on any of your units makes you comply with the potential exterior use of your web site visitors.
Additionally deployed concurrently is an XMRig miner course of recognized as “mylovelyminer” with its mining server pointing to “ota.proxystream[.]st.” Notably, one other subdomain related to the identical area, “world.relay.proxystream[.]st,” was flagged by Bitsight in August 2026 in reference to the AISURU DDoS and proxyware botnet.
Posts on Reddit point out that a number of Plex customers have had their situations compromised with the identical “mylovelyminer” payload. That mentioned, it isn’t recognized at this stage if it stems from the exploitation of Plex2Shell flaws.
The event comes greater than a month after Plex urged customers to replace their situations to the newest model following the discharge of an replace that addressed a number of unspecified safety flaws.
It is unclear if the aforementioned vulnerabilities had been a part of this alert. The Hacker Information has contacted Plex for remark and we’ll replace the story if we hear again. In mild of lively exploitation, customers are suggested to maintain their Plex installations up-to-date for optimum safety.
