Hackers are using a public exploit chain called Plex2Shell against unpatched Plex Media Server systems and installing cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit code went public on October 16, 2026.
How the Plex2Shell chain works
Plex2Shell links four flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, they let a remote user run code on a server without a password. The code runs with the same rights as the Plex service. Security researcher Zach Main found the bugs and reported them to Plex on July 27. Plex confirmed the report and paid a bounty on August 4.
The first flaw is a server-side request forgery issue in the /player/timeline endpoint. The server checks whether a token exists, but it does not verify that the token is valid, so a fake token is enough. An attacker can place a full web address in the protocol field and make Plex send a request to itself. That request appears to come from the machine itself, which Plex trusts more, and it opens a plugin interface that normally needs no token for local traffic. A broken check in the plugin code then lets the attacker call other plugin functions.
The next stage uses a TVDB plugin function and a web address that starts with 127.0.0.1 but points to an attacker-controlled server. Plex sees the local prefix and adds the owner’s admin token to the request. The token goes to the attacker. With that token, the attacker changes a transcoder setting so Plex writes a malicious file into its codec folder. The file is hidden inside a video, and the next time Plex transcodes a video, it loads the file and runs it. The researcher’s write-up and proof-of-concept code are public on GitHub.
First signs of live attacks
A researcher running a honeypot, which is a decoy server used to watch attacks, saw the first real exploitation on October 17. The attackers dropped an XMRig-based Monero miner and a Linux proxy tool called myawesomeproxy. The Hacker News reports that the miner pointed to a domain tied to the AISURU botnet. The attacks fetched payloads from 217.60.194[.]116.
Cybersecurity News also covered the first exploitation reports and noted that the evidence did not show how many real servers were hit. The attack is not limited to home servers. QNAP says some NAS users have been breached, and BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities list on October 20.
Exposure, patching, and response
Plex Media Server often listens on port 32400, and many people leave it open to the internet so they can stream from anywhere. That makes it a target for anyone scanning for it. Update to Plex Media Server 1.43.3.10861 or newer, and check the version the server actually reports. Updating will not remove a payload that is already installed.
QNAP advises treating an exposed server as compromised, checking for signs of infection, doing a clean reinstall, and resetting credentials. Stop forwarding port 32400 if you do not need remote access. If you do need it, use a VPN. Check the Plex process for strange child processes, unknown downloads, and high CPU use. Miners often show up first as a slow, hot server. The source also points to another Redis cryptojacking campaign as a separate example of exposed services being turned into miners.
Licensed under CC BY-ND 4.0 International