Science & Tech · Cybersecurity · 3 hrs ago
Hackers Use Plex Flaws to Install Crypto Miners and Proxy Software
Attackers used Plex flaws to target exposed media servers after exploit code became public on October 16.
The flaws, known as Plex2Shell, affect Plex Media Server versions older than 1.43.3.10861 and allow code to run without a valid login.
On October 17, a researcher saw attackers use the exploit on a deliberately vulnerable internet-facing Plex honeypot.
They installed a cryptocurrency miner and software that can route other people’s internet traffic through the server, using a home connection as a proxy.
Shadowserver counted nearly 49,000 vulnerable servers still exposed on Saturday.
Plex released a fix in August and has urged server owners to update to the latest version.
Attackers used the Plex2Shell vulnerability chain to install a cryptocurrency miner and proxy software on an exposed Plex server.
The attacks were observed on a vulnerable server set up as a honeypot, using exploit code released publicly by the researcher who found the flaws.
The four vulnerabilities allow attackers without valid credentials to run code on exposed Plex Media Servers.
Plex released a fix in August and urged server owners to update, but Shadowserver data cited by Gizmodo showed nearly 49,000 vulnerable servers remained exposed as of Saturday.
- Who
- Threat actors targeted exposed Plex Media Servers. A researcher who set up a honeypot observed the attacks.
- What
- Attackers exploited the Plex2Shell chain to install a cryptocurrency miner and proxy software.
- When
- The attacks were observed on October 17, one day after technical details and proof-of-concept code went public.
- Where
- On an internet-facing Plex honeypot running a vulnerable release.
- Why
- The attackers installed a miner and proxy software; the sources say the proxy could route traffic through a victim’s home internet connection.
This story does not have two clearly opposing sides.
ZM reported the vulnerabilities to Plex.
Plex confirmed the issues, awarded a bug bounty and made a fixed build publicly available.
Plex published an advisory recommending that server owners update.
ZM released technical details and proof-of-concept code for Plex2Shell.
A researcher observed attackers using the exploit on a vulnerable Plex honeypot.
- Vulnerability chain
- Plex2Shell; four vulnerabilities
- CVE identifiers
- CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656
- Fixed release
- Plex version 1.43.3.10861
- First observed attack
- October 17, 2026
- Observed payloads
- XMRig cryptocurrency miner and myawesomeproxy
- Exposed vulnerable servers
- Nearly 49,000 as of Saturday, according to Shadowserver data cited by Gizmodo
3 sources
What people are saying
If you run Plex at home, update it today
As of this morning (Oct 17th), I finally saw in the wild exploitation using exploit code from the authors github
Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails
Patch your servers!
Posts on X
Unauthenticated RCE chain in Plex: $500 bounty Writeup: https://t.co/mpFPDLCPde PoC: https://t.co/cOli9jBryw Patch your servers!
If you run Plex at home, update it today. Exploit code for a four bug chain that gives unauthenticated code execution on Plex Media Server went public two days ago, and attackers were using it on a honeypot within a day to drop a Monero miner. Patched builds have been out since