Plex2Shell Exploits Turn Unpatched Media Servers Into Crypto Miners
Public Exploit Weaponized Within a Day
Home media servers running Plex are under active attack. On October 16, security researcher Zach Main published a technical write-up and proof-of-concept code for an exploit chain he calls Plex2Shell. Roughly a day later, on October 17, a researcher operating an internet-facing honeypot on an older Plex build watched attackers use that same public code to break in, as reported by Gizmodo and CordCuttersNews. It was the first documented case of in-the-wild exploitation, and it showed how fast a published exploit can be turned against the machines that never got patched.
Four Flaws, No Login Required
Plex2Shell is not a single bug but four vulnerabilities chained together: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. According to The Hacker News, the chain lets an attacker with no valid credentials trick a server into handing over its owner's admin token, then abuse a server-side request forgery flaw in the video transcoding endpoint to fetch an attacker-hosted payload and write a forged codec library to a chosen path. The malicious code runs the next time Plex transcodes a video, with the same privileges as the Plex service itself. A fifth flaw, CVE-2026-96651, was disclosed alongside the four, and the most severe of the set, CVE-2026-96656, carries a CVSS score of 8.6.
A Patch From August That Tens of Thousands Skipped
Main reported the flaws to Plex on July 27, 2026, and the fixed release, version 1.43.3.10861, shipped on August 3, with Plex announcing the fixes publicly on September 1. But patching stalled. Citing Shadowserver Foundation scans, BleepingComputer reported that on September 9, six weeks after the fix, more than 36,000 of roughly 300,000 internet-exposed Plex servers were still running vulnerable versions. When the full proof of concept went public on October 16, many of those machines were still exposed, and exploitation began within about 24 hours, according to SecurityWeek.
Miners Burn the CPU While a Proxy Sells the Connection
The honeypot captured two payloads. Security Affairs reports the first was a cryptocurrency miner built on XMRig, the widely abused open-source Monero miner, which pins the victim's CPU while the machine slows to a crawl. The second payload, appearing later the same day, was a program called myawesomeproxy. The Hacker News notes that running it displays a message saying the operator agrees to "the potential external use" of their internet connection. In practice, it converts the compromised box into a residential proxy node, letting strangers route their traffic through the victim's home connection, a setup SecurityWeek describes as proxy software rented out to make malicious traffic look like ordinary household browsing. Users on Reddit and Neowin have since reported their own servers running hot and slow, confirming the miner infections.
