Malicious actors have started to take advantage of a series of vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy software, just one day after a proof-of-concept (PoC) was released to the public.
A researcher known online as boredhackerblog reported that the exploitation involves a combination of four distinct vulnerabilities, collectively referred to as Plex2Shell.
The vulnerabilities are as follows:
- CVE-2026-96652 (CVSS score: 5.3) – An unauthenticated server-side request forgery (SSRF) that arises from the “/player/timeline” endpoint, exploiting the lack of validation on the “protocol” parameter inserted into a programmatically constructed player URL, enabling an attacker to compel the Plex server to POST to a destination of their choosing.
- CVE-2026-96654 (CVSS score: 6.9) – An improper handling of URL values in the “searchOne” endpoint that could permit an attacker to invoke functions from other plugins and provide their own parameters to acquire the owner’s admin token.
- CVE-2026-96655 (CVSS score: 5.3) – An SSRF vulnerability that allows an authenticated user (i.e., the owner token) to request arbitrary internal or external addresses (for example, an attacker-controlled carrier video containing the malicious ELF payload) through the ‘/video/:/transcode/universal’ path parameter.
- CVE-2026-96656 (CVSS score: 8.6) – A vulnerability involving external control of file names or paths that writes the ELF shared object to a path chosen by the attacker in the Codecs directory and executes it.
In other words, these vulnerabilities can be exploited in sequence to achieve unauthenticated remote code execution on vulnerable Plex Media Server instances.
The vulnerabilities, along with CVE-2026-96651 (CVSS score: 7.1), were reported to Plex on July 27, 2026, by security researcher Zach Main, and were addressed in Plex Media Server version 1.43.3.10861, released on August 3, 2026.
Attempts to exploit these vulnerabilities in the wild have been documented just one day after the technical details of the Plex2Shell chain were made public on October 16, 2026. The attacks utilize a shell script to download and deploy a miner payload (“x12345”) hosted on a remote server (“217.60.194[.]116”) using wget or curl.
The following IP addresses have been observed in connection with these attack efforts:
- 91.92.40[.]202
- 176.65.139[.]228
- 45.194.92[.]222
- 176.65.139[.]228
Additionally, the vulnerabilities have been leveraged to deliver an artifact named “myawesomeproxy,” which, according to VirusTotal, is a covert Linux backdoor and reverse proxy. Running this program displays the following message, as noted by boredhackerblog:
“Running this software on any of your devices makes you agree to the potential external use of your internet traffic.”
Simultaneously, an XMRig miner process identified as “mylovelyminer” has also been deployed, with its mining server directed to “ota.proxystream[.]st.” Notably, another subdomain linked to the same domain, “global.relay.proxystream[.]st,” was flagged by Bitsight in August 2026 in relation to the AISURU DDoS and proxyware botnet.
Reddit posts indicate that numerous Plex users have experienced compromises of their instances with the same “mylovelyminer” payload. However, it remains unclear at this time whether this is a result of the Plex2Shell vulnerabilities.
This development follows a month after Plex advised users to update their instances to the latest version after releasing an update that addressed several unspecified security issues.
It is uncertain if the vulnerabilities mentioned were included in this alert. The Hacker News has reached out to Plex for a statement and will provide updates if a response is received. Given the ongoing exploitation, users are encouraged to keep their Plex installations updated for maximum security.
Source: Original article
