Plex2Shell exploit chain hit internet-facing Plex servers a day after PoC release
A researcher's honeypot running a vulnerable Plex Media Server recorded in-the-wild exploitation on October 17, with attackers dropping an XMRig-based miner and proxy software.
Threat actors started targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public, SecurityWeek reported.
The researcher who found the bugs published a write-up and proof-of-concept code on October 16. The flaws can be combined to run arbitrary code on an exposed server without valid credentials, with the code running at the same privileges as the Plex service. Two of the four are tracked as CVE-2026-96652 and CVE-2026-96654.
According to the report, the issues were reported to Plex on July 27, confirmed with a bug bounty awarded on August 4, and Plex said on September 1 that it had already shipped fixes and asked server owners to upgrade.
A separate researcher caught the activity using an internet-facing Plex honeypot on a vulnerable release. Before October 17, the decoy had mostly drawn reconnaissance scans and generic attempts. On October 17 the researcher saw exploitation, and said attackers used the public exploit, possibly with tweaks.
The honeypot recorded an XMRig-based cryptocurrency miner, then later a second program, myawesomeproxy, which the researcher identified as proxy software. The researcher suggested residential Plex hosts could be attractive as proxies for reaching corporate VPNs and email, and cautioned that the published indicators of compromise cover only honeypot activity.
For defenders, the practical step is upgrading Plex Media Server as Plex advised, and checking internet-exposed instances for unexpected processes or outbound proxy traffic.
CVE references
Sources
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure - SecurityWeekPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning