Attackers exploit four Plex flaws to deploy miner and proxy malware

In a new development, attackers are actively exploiting a chain of four Plex Media Server vulnerabilities to install cryptocurrency mining and residential proxy malware on unpatched systems since Oct. 17, 2026.

Attackers are actively exploiting a chain of four Plex Media Server vulnerabilities to install cryptocurrency mining and residential proxy malware on unpatched systems. The exploited chain consists of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, collectively named Plex2Shell, and enables unauthenticated remote code execution with the same privileges as the Plex service. Researcher ZM reported the vulnerabilities to Plex on Jul. 27, 2026, and Plex awarded a $500 bug bounty on Aug. 4, 2026.

On that same day, Plex released a security update that fixed the four vulnerabilities, making version 1.43.3.10861 publicly available. Plex issued a public advisory on Sep. 1, 2026 urging server owners to update, and researchers published technical details plus a working exploit for Plex2Shell on Oct. 16, 2026. Within one day, attackers were observed using the exploit in the wild, with first detections on Oct. 17, 2026.

Observed attacks have deployed an XMRig‐based cryptocurrency miner and a residential proxy application called myawesomeproxy that routes traffic through the compromised home network. The malicious payload resides in the Plex Codecs directory and runs with each transcoder execution (the process of converting media files), so stopping the miner does not remove the threat. Shadowserver data showed nearly 49,000 Plex servers still exposed on Saturday Oct. 18, 2026, with about 25,100 in North America and 17,600 in Europe.

Administrators should upgrade Plex Media Server to version 1.43.3.10861 or newer immediately. After updating, administrators ought to examine process trees for any unexpected child processes of the main Plex binary. They should also inspect the Codecs directory for unknown files and scan network logs for indicators of compromise. If external connectivity is not required, they should disable the Remote Access feature and apply network segmentation to limit exposure of port 32400.

Systems suspected of compromise need user accounts, scheduled tasks and outbound traffic reviewed, with reinstallation from a clean base considered the most reliable recovery. Plex requested CVE identifiers for the flaws, which were assigned on Sep. 23, 2026. Earlier September assessments identified more than 36,000 internet‐facing Plex instances lacking the recommended updates. Three weeks after fixing the four vulnerabilities, Plex published CVE designations that revealed five vulnerabilities, one rated 8.6 out of 10 in severity.

Plex’s terms of service permit the company to require an update to protect the solution, though after the Sep. 1 advisory it only recommended updating and did not mandate it. Plex pointed Windows and Mac users to an optional automatic‐update setting that defaults to “Ask me”. Linux, Docker, and NAS installations depend on package managers, container restarts, or manual downloads for updates.

“Unauthenticated RCE chain in Plex,” ZM posted alongside the write-up and proof-of-concept code. “Patch your servers!”, That breach also included installation of a keylogger on a senior DevOps engineer’s home computer, and a private report linked the exploited package to Plex, though LastPass and Plex have not publicly confirmed the connection.