Back Feeds.Feedburner

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Feeds.Feedburner •Eduard Kovacs • October 19, 2026

Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public.

The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. The code runs with the same privileges as the Plex service.

The issues were reported to Plex on July 27, and the company confirmed them and awarded a bug bounty on August 4. On September 1, Plex announced it had already shipped fixes and asked server owners to upgrade.

A different researcher caught the attacks by setting up an internet-facing Plex honeypot running a vulnerable release. Before October 17, the decoy had drawn largely reconnaissance scans and generic attack attempts.

“As of this morning (Oct 17th), I finally saw in the wild exploitation,” the researcher wrote. The attackers used the publicly released exploit, the researcher said, though they may have tweaked the code.

The attackers were observed dropping a cryptocurrency miner built on XMRig. Later that day, a second program called myawesomeproxy also appeared on the honeypot. The researcher identified it as proxy software, and it shows a notice saying that anyone running it agrees to the potential use of their internet traffic.

“Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the researcher wrote.

The researcher cautioned that the published indicators of compromise cover only activity seen on the honeypot.

In its September advisory, Plex recommended that all server owners install the newest release without delay.

Related : Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack

Related : MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

Related : Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Related : F5, Juniper Networks Patch Critical Vulnerabilities

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Plex2Shell Exploit Chain Actively Targeting Vulnerable Plex Servers A chain of vulnerabilities in Plex Media Server, termed Plex2Shell, is being by attackers to gain unauthorized access and deploy cryptocurrency miners and proxy software. The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, allow unauthenticated remote code execution on servers running versions prior to 1.43.3.10861. The first public proof-of-concept code was released on October 16, 2026, and exploitation was observed starting October 17, 2026, when a researcher operating a honeypot reported the deployment of a XMRig miner and a proxy tool called myawesomeproxy. Plex had previously issued a patch for these vulnerabilities on August 4, 2026, and advised users to update their installations. Despite this, many servers remain unpatched, with over 36,000 instances still exposed to the internet. The ongoing exploitation poses a significant risk to users who have not yet updated their systems. 25 sources 73

Extracted Entities

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)