Cybercriminals are actively targeting unpatched, internet-facing Plex Media Server installations using a newly disclosed four-bug exploit chain dubbed “Plex2Shell.” Within a day of the technical details and proof-of-concept code becoming public on October 16, 2026, security researchers observed threat actors weaponizing the flaws to achieve unauthenticated remote code execution, hijacking vulnerable systems to deploy cryptocurrency miners and Linux residential proxy backdoors.

The exploitation activity was captured on October 17, 2026, by a security researcher operating under the alias boredhackerblog, who monitored an internet-facing Plex honeypot running an older, vulnerable software release, according to The Hacker News and SecurityWeek. While SecurityWeek notes in its headline that the exploit chain was weaponized hours after disclosure, its body text aligns with Security Affairs in dating the public proof-of-concept release to October 16 and the confirmed honeypot compromise to the morning of October 17.

Inside the Plex2Shell Vulnerability Chain

The vulnerabilities were originally discovered and reported to Plex on July 27, 2026, by security researcher Zach Main. As noted by Ars Technica, five CVE designations were ultimately published from the research, though the Plex2Shell exploit chain relies on combining four specific flaws in sequence. A fifth vulnerability disclosed alongside the chain, tracked as CVE-2026-96651 (CVSS score 7.1), is not required for the attack.

According to technical breakdowns reported by The Hacker News and Cord Cutters News, the four-part chain operates without requiring valid user credentials:

  • CVE-2026-96652 (CVSS 5.3): An unauthenticated server-side request forgery (SSRF) vulnerability triggered via the /player/timeline endpoint when an attacker supplies any arbitrary value in the token header.
  • CVE-2026-96654 (CVSS 6.9): A flaw involving internal searchOne and plugin calls on the loopback interface that enables the attacker to steal the server owner’s administrative security token via crafted network callbacks.
  • CVE-2026-96655 (CVSS 5.3): An authenticated SSRF vulnerability within the universal transcode path.
  • CVE-2026-96656 (CVSS 8.6): An arbitrary-path file-write flaw that lets attackers manipulate transcoder preferences to write malicious shared object (.so) or dynamic-link library files directly into the Plex Codecs directory.

As detailed by Security Affairs, the final stage abuses how the media server handles shared libraries. When Plex loads a shared object from the codec directory using dlopen, it does not check for a lib prefix, verify digital signatures, require executable permissions, or check for specific exported symbols. Instead, it immediately runs the library’s ELF constructor functions (DT_INIT_ARRAY). By triggering a second transcode operation, the attacker forces the server to re-enumerate the codec directory and execute the planted payload under the privileges of the Plex service account (such as uid=1000(plex)).

While the highest individual severity score in the group is 8.6 out of 10, The Proof Desk notes that Main rated the combined chain at 9.8 under the CVSS 3.1 standard due to its ability to execute code over the network without authentication or user interaction. Main also stated he used a large language model heavily to speed up the iterative process of developing the proof-of-concept code, while making the prioritization and judgment calls himself.

Cryptominers and Residential Proxy Payloads

Once the honeypot was configured to permit outbound connections, it recorded attacks originating from IP addresses 45.194.92.222 (using a Python-urllib/3.10 user agent), 91.92.40.202, and 176.65.139.228. The compromised server subsequently fetched malicious payloads from 217.60.194.116 and a second-stage loader from 77.90.185.205.

The attacks installed two primary payloads. The first is a UPX-packed build of the open-source XMRig Monero cryptocurrency miner, deployed via scripts under process names like mylovelyminer or x (and referenced in indicators as x12345). On the researcher’s honeypot, the miner consumed roughly 97% of the available CPU resources and communicated with a mining pool at ota.proxystream.st:3333 using the rig identifier plexdocker. Another subdomain on the same infrastructure, global.relay.proxystream.st, was previously flagged by security firm Bitsight in August 2026 in connection with the Aisuru DDoS and proxyware botnet, though no formal threat actor attribution has been established for the Plex attacks.

The second payload is a stealthy Linux backdoor and reverse proxy named myawesomeproxy. When executed, the binary outputs a message stating: “Running this software on any of your devices makes you agree to the potential external use of your internet traffic.” In practice, this turns the victim’s residential internet connection into an exit node for third-party traffic. As boredhackerblog noted, threat actors prize residential IP proxies because they allow attackers to mask illegal traffic and bypass security controls when accessing corporate VPNs and email systems.

While the confirmed Plex2Shell exploitation was recorded on a single controlled honeypot, The Hacker News notes that multiple Plex users on Reddit have reported finding their servers compromised with the same mylovelyminer payload, though it remains unconfirmed whether those specific compromises resulted from the Plex2Shell chain.

How to Patch and Protect Your Plex Server

Plex addressed these vulnerabilities weeks before the exploit code became public, though reporting varies slightly on the exact patch timeline. According to The Hacker News, Plex confirmed the bugs on August 4 and released the patched build, Plex Media Server version 1.43.3.10861, on August 3, 2026, before issuing a public security advisory on September 1. Meanwhile, Ars Technica and The Proof Desk describe the 1.43.3 fix as arriving at the start of September 2026, and SecurityWeek reports that Plex announced on September 1 that fixes had already shipped.

Regardless of the release chronology, all servers running version 1.43.2 or earlier are vulnerable. Scanning data cited by Cord Cutters News indicated that more than 36,000 internet-facing Plex instances remained unpatched as of September.

Administrators should take the following steps immediately:

  • Update to Build 1.43.3.10861 or Later: Check every host—including Windows, Linux, macOS, Docker containers, and Network Attached Storage (NAS) devices—and update to at least version 1.43.3.10861. Enable automatic updates if supported by your platform.
  • Restrict Internet Exposure: The exploit requires network access to the Plex port (typically port 32400). If remote streaming is not needed, restrict the server to local network access only. If remote access is required, Ars Technica notes that routing traffic through a properly configured reverse proxy can help reduce direct exposure to the open internet.
  • Audit for Indicators of Compromise: Updating the software removes the vulnerability, but it does not evict malware that has already been installed. Check system monitors for sustained high CPU usage (near 97%), inspect running processes for suspicious names like mylovelyminer, myawesomeproxy, or x12345, and examine the Plex Codecs directory for unfamiliar .so or dynamic-link library files that could re-execute during future transcoding jobs.

Frequently Asked Questions

Which Plex Media Server versions are safe from Plex2Shell?

Plex Media Server build 1.43.3.10861 and newer versions contain the patches for the Plex2Shell vulnerability chain. Any installation running version 1.43.2 or earlier is susceptible and should be updated immediately.

Am I at risk if my Plex server is not exposed to the internet?

Your risk is significantly lower if port 32400 is not reachable from the public internet. However, because the exploit requires no authentication, any device or compromised host on your local network could still trigger the chain. Local-only servers should still be updated.

What should I do if I find mylovelyminer or myawesomeproxy on my system?

If you detect unauthorized child processes spawned by the Plex binary, unfamiliar files in the Codecs directory, or connections to proxystream.st, do not rely solely on a software update. Isolate the host from the network, terminate the malicious processes, remove any unauthorized shared libraries from the Plex directories, and investigate the host for persistence mechanisms.

Sources

Read More