Vulnerabilities · Application Security
Attackers use Plex2Shell flaws to hijack Plex servers for mining and proxies
Attackers began exploiting four Plex Media Server flaws just hours after public disclosure, installing cryptocurrency miners and proxy software on vulnerable servers, according to SecurityWeek.
Ross GrantUpdated 2 min read
The short version
Attackers found a way to break into Plex Media Servers by using four linked security flaws. They used these flaws to install software that mines cryptocurrency and turns servers into internet proxies. Plex released fixes in September, so anyone running Plex should update to stay safe. Only one source has reported this so far, so details may change as more information comes out.
What happened?
Attackers began exploiting four vulnerabilities in Plex Media Server, known as Plex2Shell, just hours after technical details and exploit code were published, according to SecurityWeek. The flaws allow attackers to run code on vulnerable servers without valid credentials. Attackers have been seen installing cryptocurrency miners and proxy software on affected servers. Plex released fixes in September and advised all server owners to update.
How the flaw works
According to SecurityWeek (opens in a new tab), attackers began exploiting a set of four vulnerabilities in Plex Media Server, known as Plex2Shell, within hours of technical details and proof-of-concept code being published. The vulnerabilities are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. When combined, they allow an attacker to run any code they want on a vulnerable Plex server, even if they do not have valid login credentials. The code runs with the same permissions as the Plex service itself, which often means significant control over the server.
How the attack worked
A security researcher set up a honeypot (a decoy server meant to attract attackers) running a vulnerable version of Plex Media Server. Before the public release of the exploit, the honeypot mostly saw basic scans and generic attacks. On October 17, the researcher observed real-world exploitation using the published exploit code, possibly with minor changes. Attackers first installed a cryptocurrency miner based on XMRig, a common tool for mining Monero. Later, they deployed a program called myawesomeproxy, which turns the compromised server into a proxy. This means attackers could use the server's internet connection for their own purposes, such as accessing corporate VPNs or sending emails that appear to come from a legitimate residential IP address.
The response
The researcher who discovered the vulnerabilities reported them to Plex on July 27. Plex confirmed the issues and paid a bug bounty on August 4. By September 1, Plex had released fixes and advised all server owners to update immediately. The company warned that running outdated versions could leave servers open to attack. The indicators of compromise published by the researcher only cover activity seen on the honeypot, so other attacks may look different.
Is there a fix?
Plex has already shipped updates that address these vulnerabilities. Server owners should upgrade to the latest version as soon as possible. Anyone running an exposed Plex server should check for signs of compromise, such as unexpected processes or network activity, and update immediately if they have not already done so.
Claimed vs confirmed
- Unconfirmed
Attackers exploited Plex2Shell vulnerabilities within hours of public disclosure.
Only SecurityWeek has reported this so far, based on a researcher's honeypot observations.
- Unconfirmed
Compromised servers were used to mine cryptocurrency and act as proxies.
This was observed on a honeypot by a researcher and reported by SecurityWeek; not yet confirmed by Plex or other sources.
Why it matters
Plex Media Server is popular for streaming media at home and in small businesses. Servers left unpatched can be hijacked to mine cryptocurrency or act as proxies for criminal activity, putting both owners and others at risk.
Key points
- Attackers exploited Plex2Shell flaws within hours of public disclosure.
- The vulnerabilities allow remote code execution without valid credentials.
- Compromised servers have been used for cryptocurrency mining and as proxies.
- Plex released fixes in September and urged immediate updates.
- Only one source has reported these attacks so far; details may change.
Sources
SecurityWeek
Reference