Recent cyberattacks have taken advantage of Plex2Shell vulnerabilities to compromise unpatched Plex Media Server systems. This exploit chain, which surfaced after the public release of the exploit code on October 16, 2026, allows attackers to deploy cryptocurrency miners and proxy software on affected servers.
Understanding the Plex2Shell Vulnerabilities
The Plex2Shell exploit chain comprises four security flaws identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These vulnerabilities enable unauthorized remote code execution on servers, as discovered by security researcher Zach Main. Plex was notified of these issues on July 27, and confirmed the vulnerabilities, subsequently awarding a bounty on August 4.
Plex Media Server, which often operates on port 32400, is vulnerable when exposed to the internet, allowing attackers to easily locate and target it. The primary vulnerability is a server-side request forgery in the /player/timeline endpoint, which permits the use of unauthorized tokens to manipulate Plex servers into executing malicious requests.
Exploitation Techniques and Consequences
Attackers exploit a flaw in the plugin interface by using a TVDB plugin function with a manipulated web address. This address, appearing as a local request, tricks Plex into appending an administrator token, granting attackers heightened control. With this token, attackers can modify transcoder settings to embed harmful files within Plex’s codec folder, which are executed during video transcoding.
These exploits were first observed in the wild on October 17, when attackers deployed an XMRig-based Monero miner and a Linux proxy tool named “myawesomeproxy.” Evidence links the miner to the AISURU botnet, with payloads being retrieved from specific IP addresses.
Preventative Measures and Recommendations
Organizations and individuals using Plex Media Server are advised to upgrade to version 1.43.3.10861 or newer to mitigate these vulnerabilities. However, updating alone will not remove any installed malicious payloads. Users should treat exposed servers as compromised, thoroughly check for signs of infection, perform a clean reinstall, and reset all credentials.
To further secure systems, users are encouraged to stop forwarding port 32400 unless absolutely necessary, opting instead for a VPN to facilitate remote access. Monitoring for unusual processes, downloads, and CPU usage is crucial, as these may indicate mining activities.
Vulnerable systems continue to be a significant target for attackers. By integrating threat intelligence from multiple sources, security operations centers can swiftly address and mitigate such incidents.
