Threat actors have begun exploiting a series of vulnerabilities in Plex Media Server, known collectively as Plex2Shell, to deploy cryptocurrency miners and reverse proxy software. This activity was reported shortly after a proof-of-concept (PoC) was made public on October 16, 2026, highlighting the urgency for users to secure their systems.
According to researcher Zach Main, who disclosed the vulnerabilities to Plex on July 27, 2026, the exploitation involves chaining four distinct vulnerabilities. These include CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which have varying CVSS scores ranging from 5.3 to 8.6. The most critical of these, CVE-2026-96656, allows attackers to execute arbitrary code on vulnerable Plex Media Server instances by manipulating file paths.
Details of the Vulnerabilities
- CVE-2026-96652 (CVSS score: 5.3) – An unauthenticated server-side request forgery (SSRF) vulnerability that allows attackers to force the Plex server to POST to arbitrary destinations.
- CVE-2026-96654 (CVSS score: 6.9) – An improper neutralization of URL values that could enable attackers to call functions of other plugins and obtain admin tokens.
- CVE-2026-96655 (CVSS score: 5.3) – Another SSRF vulnerability allowing authenticated users to request arbitrary addresses.
- CVE-2026-96656 (CVSS score: 8.6) – A critical vulnerability that allows attackers to execute code by placing malicious files in the Codecs directory.
These vulnerabilities can be exploited in sequence to achieve unauthenticated remote code execution on susceptible Plex Media Server instances. Following the public disclosure, in-the-wild exploitation attempts were recorded, leading to the deployment of a miner payload from a remote server.
Current Exploitation Activity
Recent attacks have been traced back to several IP addresses, including 91.92.40[.]202 and 176.65.139[.]228. The exploitation has resulted in the deployment of a Linux backdoor and reverse proxy named “myawesomeproxy,” which has been flagged on VirusTotal as a stealthy threat. Additionally, an XMRig miner process identified as “mylovelyminer” has been observed, with its mining server pointing to a domain associated with previous DDoS botnet activity.
Reports from users on Reddit indicate that multiple Plex instances have been compromised with the “mylovelyminer” payload, although it remains unclear if these incidents are directly linked to the Plex2Shell vulnerabilities.
Recommendations for Users
Plex had previously urged users to update their installations to the latest version following the release of a patch on August 3, 2026, which addressed multiple security flaws. Given the current exploitation of the Plex2Shell vulnerabilities, users are strongly advised to ensure their Plex Media Server is updated to the latest version to mitigate potential risks.
As the situation develops, Plex has been contacted for further comment, and updates will be provided as more information becomes available. For now, maintaining up-to-date software is critical for safeguarding against these active threats.
For more details on the vulnerabilities, refer to The Hacker News.
