Threat actors exploit Plex2Shell within one day of PoC release

SecurityWeek says threat actors began exploiting the Plex2Shell exploit chain within roughly one day after its public disclosure on October 16, 2026, deploying XMRig‑based cryptocurrency miners and the myawesomeproxy program on internet‑facing Plex servers observed on October 17, 2026.

Zach Main says on October 16, 2026, he published the proof‑of‑concept code and details for the Plex2Shell exploit chain, which comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. He says the individual CVSS scores are 4.3 for CVE-2026-96652, 6.5 for CVE-2026-96654, 4.3 for CVE-2026-96655 and 7.2 for CVE-2026-96656. He says he rated the full Plex2Shell chain 10 out of 10 on the CVSS 3.1 scale. He says he reported the vulnerabilities to Plex on July 27, 2026; the company confirmed them and awarded a bug bounty on August 4, 2026.

Plex says it released the patched Media Server version 1.43.3.10861 to all users on August 4, 2026. Plex says on September 1, 2026, it issued an advisory urging owners of versions 1.43.2 and earlier to update immediately to address the vulnerabilities. Plex says the advisory also covered Plex Desktop version 1.115.0, and NAS users may need to install the update manually as packages can lag in manufacturer app stores.

The exploit chain begins with an unauthenticated server‑side request forgery on the player timeline endpoint that accepts any token value, allowing attackers to steal the administrator’s token and execute code with Plex service privileges. After gaining the admin token, the chain manipulates transcoder preferences to write attacker‑controlled files into the Codecs directory, which the transcoder loads and executes when it initializes with Plex service privileges. Later stages of the chain pivot to internal agent functions on the loopback interface and steal the server owner’s administrative token through crafted network callbacks. Executing the chain requires outbound network access from the target server to download payloads and establish callbacks.

Successful exploitation downloads payloads from the attacker‑controlled IP address 217.60.194.116, including files named ‘docker’ and ‘x’, and deploys an XMRig‑based cryptocurrency miner and the myawesomeproxy residential proxy tool. The myawesomeproxy tool alerts users that their internet traffic may be used, indicating its function as a residential proxy for threat actors. A honeypot recorded attack traffic from IP addresses 45.194.92.222, 91.92.40.202 and 176.65.139.228, with payloads fetched from 217.60.194.116 on October 17, 2026.

Defenders should look for unexpected child processes of the Plex binary using the ‘ps axjf’ command (which lists all processes with hierarchical formatting) on Linux systems. More indicators include process names or command lines containing ‘mylovelyminer’, ‘x12345’, ‘–rig-id’, ‘–donate-level’ or the domain ‘proxystream.st’. The researcher published packed and unpacked samples of the malicious files, packet captures of the attack traffic, and recommends checking the Codecs directory for unknown files and monitoring network logs for known indicators. Because threat actors may alter ports, domains or file names, relying solely on static indicators can create blind spots in detection.

As of the October 17, 2026 honeypot report, CISA had not added the Plex2Shell CVEs to its Known Exploited Vulnerabilities catalog. Neither Plex nor CISA had published separate confirmation of widespread exploitation as of October 18, 2026. The documented exploitation has so far been limited to a single controlled honeypot, with no evidence of a large‑scale campaign against production Plex servers. In the same Reddit discussion where the researcher shared the honeypot compromise report, several users reported suspicious processes or exploitation attempts on their own servers.

Administrators should update to Plex Media Server 1.43.3.10861 or later, turn off Remote Access when it is not required, and use network segmentation to restrict access to port 32400. If a system might already be compromised, administrators should examine user accounts, scheduled tasks and outbound traffic, and consider reinstalling from a clean image as the most dependable recovery method. CISA recommends isolating a compromised system from the network, preserving logs and evidence, restoring it from a known‑clean image, and replacing passwords, keys and service secrets. OffSeq Threat Radar analysis states that no additional mitigation is required beyond applying the official Plex update.

The highest individual severity among the four CVEs is 8.6 (High) on the CVSSv4 scale, with arbitrary file write as the worst impact. Zach Main reported the vulnerabilities to Plex on July 27, 2026; the company confirmed them and awarded a bug bounty on August 4, 2026. The researcher noted that the attackers may have modified the publicly released exploit code before using it against the honeypot. The honeypot that recorded the attacks was a Linux‑based Plex deployment running inside a Docker container.