Risk actors have begun to take advantage of a series of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software program, a day after a proof-of-concept (PoC) went public.
In line with a researcher who goes by the web alias boredhackerblog, the exploitation exercise includes chaining 4 completely different vulnerabilities, collectively known as Plex2Shell.
The vulnerabilities are under –
- CVE-2026-96652 (CVSS rating: 5.3) – An unauthenticated server-side request forgery (SSRF) stemming by way of the “/participant/timeline” endpoint by profiting from the truth that the “protocol” parameter is inserted right into a programmatically-constructed participant URL with no validation, permitting an attacker to drive the Plex server to POST to a vacation spot of their alternative.
- CVE-2026-96654 (CVSS rating: 6.9) – An improper neutralization of URL values included within the “searchOne” endpoint that might permit an attacker to name different plugins’ features and provide their very own parameters to acquire the proprietor’s admin token.
- CVE-2026-96655 (CVSS rating: 5.3) – An SSRF vulnerability that enables an authenticated person (i.e., the proprietor token) to request arbitrary inner or exterior addresses (e.g., an attacker-hosted provider video carrying the malicious ELF payload) by way of the ‘/video/:/transcode/common’ path parameter.
- CVE-2026-96656 (CVSS rating: 8.6) – An exterior management of file title or path vulnerability that enables the ELF shared object to an attacker-chosen path within the Codecs listing and execute it.
Put in another way, the vulnerabilities may be mixed collectively on this order to realize unauthenticated distant code execution on inclined Plex Media Server cases.
The vulnerabilities, together with CVE-2026-96651 (CVSS rating: 7.1), had been disclosed to Plex on July 27, 2026, by safety researcher Zach Most important, and had been patched in Plex Media Server 1.43.3.10861 launched on August 3, 2026.
In-the-wild exploitation makes an attempt concentrating on the failings have since been recorded a day after technical particulars of the Plex2Shell chain went public on October 16, 2026. The assaults led to the deployment of a miner payload from a distant server (“217.60.194[.]116”).
The assault efforts have been noticed from the next IP addresses –
- 91.92.40[.]202
- 176.65.139[.]228
- 45.194.92[.]222
- 176.65.139[.]228
Moreover, the vulnerabilities have been exploited to ship an artifact named “myawesomeproxy,” which, in line with VirusTotal, is a stealthy Linux backdoor and reverse proxy. Working this system shows the under message, per boredhackerblog –
Working this software program on any of your gadgets makes you comply with the potential exterior use of your web visitors.
Additionally deployed concurrently is an XMRig miner course of recognized as “mylovelyminer” with its mining server pointing to “ota.proxystream[.]st.” Notably, one other subdomain related to the identical area, “world.relay.proxystream[.]st,” was flagged by Bitsight in August 2026 in reference to the AISURU DDoS and proxyware botnet.
Posts on Reddit point out that a number of Plex customers have had their cases compromised with the identical “mylovelyminer” payload. That mentioned, it is not recognized at this stage if it stems from the exploitation of Plex2Shell flaws.
The event comes greater than a month after Plex urged customers to replace their cases to the newest model following the discharge of an replace that addressed a number of unspecified safety flaws.
It is unclear if the aforementioned vulnerabilities had been a part of this alert. The Hacker Information has contacted Plex for remark and we’ll replace the story if we hear again. In gentle of energetic exploitation, customers are suggested to maintain their Plex installations up-to-date for optimum safety.
