Threat actors have started exploiting a series of security flaws in Plex Media Server to install cryptocurrency mining software and reverse proxy tools, just one day after technical details of the attack method became public. The exploitation was reported by a researcher operating under the alias boredhackerblog, who documented active attacks leveraging a four-vulnerability chain known as Plex2Shell. The attacks allow intruders to achieve unauthenticated remote code execution on vulnerable Plex installations.
The attack chain links together four separate vulnerabilities, each enabling a distinct step toward full system compromise. The sequence begins with CVE-2026-96652, an unauthenticated server-side request forgery flaw that forces the Plex server to send POST requests to attacker-controlled destinations through an unvalidated "protocol" parameter in the "/player/timeline" endpoint. Next comes CVE-2026-96654, which permits attackers to invoke other plugins' functions and capture the owner's admin token by exploiting improper neutralization of URL values in the "searchOne" endpoint. The third vulnerability, CVE-2026-96655, lets an authenticated user—armed with the stolen owner token—request arbitrary internal or external addresses, such as an attacker-hosted video file carrying a malicious ELF payload. Finally, CVE-2026-96656 allows external control of file paths, writing the ELF shared object to an attacker-chosen location in the Codecs directory and executing it. Security researcher Zach Main disclosed these flaws to Plex on July 27, 2026, and the company released a patch in version 1.43.3.10861 on August 3, 2026.
Wild exploitation attempts surfaced on October 17, 2026, one day after Main published proof-of-concept code on October 16. The attacks deploy a shell script that retrieves and installs a miner payload labeled "x12345" from a remote server at 217.60.194[.]116 using wget or curl commands. Attack traffic has originated from four IP addresses: 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222, and a repeat of 176.65.139[.]228. Additionally, intruders have used the Plex2Shell chain to deliver an artifact called "myawesomeproxy," which VirusTotal identifies as a stealthy Linux backdoor and reverse proxy. When executed, the program displays a message stating that running the software constitutes agreement to "the potential external use of your internet traffic," according to boredhackerblog. A concurrent XMRig miner process named "mylovelyminer" connects to a mining server at ota.proxystream[.]st, and another subdomain on the same domain—global.relay.proxystream[.]st—was linked by Bitsight in August 2026 to the AISURU DDoS and proxyware botnet.
The exploitation demonstrates how attackers can combine multiple medium-severity flaws into a critical-severity attack path that bypasses authentication entirely. Each individual vulnerability carries a CVSS score ranging from 5.3 to 8.6, but their combination enables full remote code execution without requiring any user credentials. The rapid shift from public disclosure to active exploitation—less than 24 hours—underscores the speed with which adversaries weaponize newly revealed attack techniques. Posts on Reddit indicate that multiple Plex users have discovered their systems compromised with the "mylovelyminer" payload, though it remains unclear whether these infections stem from Plex2Shell exploitation or alternative attack vectors. The development follows a September 2026 advisory in which Plex urged users to update their installations after releasing fixes for multiple unspecified security issues, though it's uncertain if the Plex2Shell vulnerabilities were part of that earlier alert.
Users running Plex Media Server should upgrade to version 1.43.3.10861 or later immediately to defend against the active exploitation campaign. The Hacker News contacted Plex for comment but had not received a response at the time of reporting. Organizations often delay patching media server software because it's perceived as low-priority infrastructure, yet this incident illustrates how entertainment platforms can serve as footholds for broader network intrusion. The coincidence of cryptomining and proxy software in the same attack suggests adversaries are monetizing compromised servers in multiple ways simultaneously.