Hackers have swiftly moved to exploit a series of vulnerabilities in Plex Media Server, deploying cryptocurrency mining software and reverse proxy tools. This activity follows the public release of a proof-of-concept (PoC) detailing the vulnerabilities, collectively known as Plex2Shell.
Exploitation of Plex2Shell Vulnerabilities
The Plex2Shell vulnerabilities have been identified as a chain of four distinct flaws, exploited together to achieve remote code execution without authentication. A researcher known online as boredhackerblog has highlighted these security issues, which affect the server’s functionality.
Among these vulnerabilities is CVE-2026-96652, a server-side request forgery (SSRF) flaw in the ‘/player/timeline’ endpoint. This issue is caused by improper parameter validation, allowing attackers to manipulate server requests. Another significant vulnerability, CVE-2026-96656, involves external control of file paths, permitting attackers to run malicious code from chosen locations.
Recorded Attacks and Deployed Malware
Following the disclosure of these vulnerabilities, Plex Media Server instances have been targeted by threat actors. These attacks, recorded from specific IP addresses, have resulted in the installation of miner payloads from remote servers. The payloads are designed to mine cryptocurrency without user consent.
Additionally, a backdoor software named ‘myawesomeproxy’ has been utilized, disguising its presence while functioning as a reverse proxy. The program’s execution prompts users with a message about potential external traffic use, indicating unauthorized access to their network resources.
Security Measures and Recommendations
The vulnerabilities, initially reported to Plex in July 2026, were addressed in an update released in August 2026. However, ongoing exploitation has been observed since the PoC release on October 16, 2026. Multiple Plex users have reported instances infected with the ‘mylovelyminer’ payload, though its exact origins remain uncertain.
In response to these threats, Plex has urged users to ensure their servers are updated to the latest version, enhancing security against these vulnerabilities. While the company has been contacted for further clarification, users are advised to remain vigilant and maintain their systems to prevent unauthorized access.
With cyber threats evolving, keeping software up-to-date is crucial for safeguarding against potential exploits. Users should prioritize installing security patches and monitoring server activity to protect their systems from similar attacks.
