Plex vulnerabilities being exploited in the wild to drop a cryptominer

A security researcher set up a honeypot after Plex disclosed critical vulnerabilities (CVE-2026-96652, 96654, 96655, 96656) affecting Plex Media Server v1.43.2 and earlier, chained together by the plex2shell exploit to achieve remote code execution. Starting Oct 17th 2026, in-the-wild exploitation was observed from multiple IPs, dropping a Docker-based cryptominer (xmrig) and later a proxy tool called myawesomeproxy. The post includes IOCs, file hashes, pcaps, and links to the original researcher's code and detection signatures, along with ongoing updates as the researcher monitored continued attacks.

Discussion centers less on the vulnerability itself and more on whether exposing Plex (or any self-hosted media server) to the internet is reckless, with many defending the practice as necessary for non-technical friends/family and others recommending Tailscale or VPNs instead.

Questions this post answers

CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 were chained together by researchers (via the plex2shell project) to achieve remote code execution on vulnerable Plex Media Server installations. Plex disclosed the security update on September 1, 2026, and in-the-wild exploitation attempting to drop a cryptominer was first observed around October 17, 2026. Admins patching Plex servers can track emerging exploit chains and IOCs on daily.dev.

Attackers deliver a Docker-based cryptominer (xmrig) after gaining remote code execution, with file hashes published for detection. A separate tool called myawesomeproxy was also observed being deployed, acting as a residential IP proxy and displaying a message warning that running it permits external use of the victim's internet traffic. Those hunting cryptomining and proxyjacking malware can follow fresh IOC writeups on daily.dev.