Cybercriminals are leveraging vulnerabilities in the Plex Media Server to install cryptocurrency mining malware. This development, reported by a researcher on October 17, 2026, highlights ongoing attacks against a test server set up as a honeypot.
Exploiting Plex Vulnerabilities
The attacks utilize a public exploit known as Plex2Shell, which chains four separate vulnerabilities to execute code without requiring authentication. Observations have also noted the presence of proxy software operating alongside the cryptominer.
According to findings by Boredhackerblog, the exploitation activity targets exposed servers, raising concerns about the number of real-world systems that could be affected. However, the exact number of compromised servers and the identities of the attackers remain unknown. Initial restrictions on outbound traffic limited payload data collection.
Details of the Plex2Shell Exploit
Plex had previously issued security updates on September 1, urging users to upgrade to Plex Media Server version 1.43.3 and Plex Desktop 1.115.0. The company’s security advisory particularly noted the need for NAS users to manually apply these updates.
The vulnerabilities involved, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, include a server-side request forgery that allows attackers to manipulate Plex’s request handling. The exploit proceeds to access internal server functions and write files to attacker-controlled locations. The critical final stage involves executing code through an unsigned codec.
Honeypot Data and Security Recommendations
The researcher’s honeypot recorded initial exploitation attempts from IP addresses such as 45.194.92[.]222. The targeted requests included references to Plex’s internal services and utilized the Python-urllib/3.10 user agent. After enabling outbound access, the researcher detected downloads from 217.60.194[.]116, including files associated with the XMRig miner.
Further investigation revealed a process named myawesomeproxy and related internet traffic, suggesting potential proxy misuse. However, the exact operators of this Plex campaign remain unidentified.
Administrators are advised to ensure Plex installations are up-to-date, specifically on NAS and Docker systems. Reviewing the Plex process tree for anomalies, conducting thorough security checks, and utilizing published packet captures can aid in detecting potential intrusions.
Conclusion and Future Outlook
As hackers continue to exploit vulnerabilities in widely used software such as Plex, the importance of timely security updates and network monitoring cannot be overstated. Organizations should remain vigilant, updating their systems promptly and employing comprehensive security practices to mitigate risks.
