Just a day after the details of the Plex2Shell exploit chain were made public, malicious actors began leveraging these vulnerabilities to target Plex Media Server systems. The chain, comprising four distinct vulnerabilities, poses a significant threat by allowing unauthorized code execution on exposed servers without needing valid credentials.
Details of the Exploit Chain
On October 16, a cybersecurity researcher published a detailed write-up along with proof-of-concept (PoC) code for the Plex2Shell vulnerabilities, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These vulnerabilities can be combined to execute arbitrary code with the same privileges as the Plex service itself.
The vulnerabilities were initially reported to Plex on July 27, with the company confirming their existence and awarding a bug bounty by August 4. Promptly, Plex released patches and urged server operators to update their systems by September 1.
Early Detection and Exploitation
To monitor activity related to these vulnerabilities, another researcher deployed a honeypot running a vulnerable version of Plex Media Server. Initially, the honeypot attracted mostly reconnaissance scans and generic attacks until October 17, when active exploitation was detected.
According to the researcher, attackers utilized the publicly available exploit code, potentially with modifications, to compromise systems. They were observed deploying a cryptocurrency miner powered by XMRig, followed by a proxy tool named myawesomeproxy, which could reroute internet traffic.
Implications and Recommendations
Such tools pose a significant risk, as they could allow threat actors to use residential IP addresses to infiltrate corporate networks and access sensitive information. The researcher emphasized that the indicators of compromise identified relate only to activities observed on the honeypot.
In response, Plex’s advisory from September reiterated the necessity for server administrators to upgrade to the latest software version to mitigate these vulnerabilities effectively. This urgent update is crucial in preventing unauthorized access and maintaining system integrity.
As cyber threats continue to evolve rapidly, staying informed and proactive about updates and patches remains a critical strategy in safeguarding digital infrastructures.
