Critical Plex Vulnerabilities Exploited to Deploy Cryptominer Malware

Key Takeaways

• Threat actors are actively exploiting critical vulnerabilities in Plex Media Server.
• The attacks leverage a public exploit chain, “Plex2Shell,” to deploy cryptocurrency mining malware.
• Affected versions include Plex Media Server 1.43.2 and earlier.
• Plex released patches on September 1, 2026, with version 1.43.3 and Plex Desktop 1.115.0 addressing the flaws.
• Evidence suggests the deployment of proxy software alongside the cryptominer, indicating potential for broader misuse.

Hackers are actively exploiting a series of critical vulnerabilities within Plex Media Server installations to deploy cryptocurrency mining malware. A security researcher documented successful attacks against a honeypot system on October 17, 2026, confirming in-the-wild exploitation.

This malicious activity follows the public release of Plex2Shell, an exploit that chains four distinct vulnerabilities to achieve unauthenticated code execution. Subsequent observations during the attacks also revealed the presence of proxy software co-existing with the cryptominer, suggesting a dual-purpose compromise.

Findings from Boredhackerblog indicate that these are not merely scanning attempts but actual exploitation of exposed test servers. While the current evidence confirms active compromise, it does not quantify the number of real-world servers affected or identify the specific threat actors behind these attacks. The researcher also noted that initial network restrictions on outbound traffic hindered the full collection of all deployed payloads.

The Plex2Shell Exploit Chain Explained

Plex proactively released security updates on September 1, 2026, urging users to upgrade to Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company’s official security notice specifically highlighted that users of Network Attached Storage (NAS) devices might need to apply these updates manually.

The Plex2Shell exploit, detailed in its Plex2Shell repository, combines four CVE-listed vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The attack sequence begins with a server-side request forgery (SSRF) vulnerability, allowing an attacker to compel the Plex server to make arbitrary requests. This initial step enables access to internal functions, escalating privileges to execute owner-authorized requests, and ultimately facilitating arbitrary file writing to a location chosen by the attacker.

The final stage of the exploit abuses the mechanism for loading unsigned codecs, leading to remote code execution. The repository identifies all Plex Media Server versions prior to 1.43.3.10828 as vulnerable, with version 1.43.3.10861 confirmed as fixed. Although the exploit supports both Linux and Windows environments, the observed honeypot activity specifically targeted a Linux-based Plex deployment running within a Docker container.

Honeypot Uncovers Cryptominer and Proxy Activity

According to the researcher’s report, the initial exploitation attempt originated from the IP address 45.194.92[.]222. Subsequent attacks were observed from 91.92.40[.]202 and 176.65.139[.]228. Analysis of recorded requests showed targets like /player/timeline/subscribe, alongside references to internal Plex services, an sslip.io hostname, and the Python-urllib/3.10 user agent.

Once outbound network access was configured, the researcher documented downloads from 217.60.194[.]116, involving files named docker and x. The collected artifacts included both packed and unpacked samples, which ultimately revealed an XMRig miner. XMRig has been frequently observed in other cyber campaigns, including those targeting exposed Redis servers, highlighting its popularity among threat actors for illicit cryptocurrency mining.

A later update to the report detailed the presence of a process named myawesomeproxy and associated traffic directed to proxystream[.]st. This program displayed a message indicating external use of the device’s internet traffic. While these findings raise significant concerns about potential proxy abuse, they do not definitively link this Plex campaign to a specific botnet or identify the operators responsible.

What You Should Do

• Update Immediately: Ensure your Plex Media Server is updated to version 1.43.3 or later, and Plex Desktop to 1.115.0 or later. NAS users may need to perform manual updates.
• Verify Version: Double-check the running version of Plex Media Server, especially on NAS systems and Docker deployments, to confirm the patch has been successfully applied.
• Inspect Process Trees: On Linux systems, examine the Plex process tree using commands like ps axjf for any unexpected child processes, suspicious downloads, or unfamiliar mining or proxy programs.
• Review Network Traffic: Monitor outbound network traffic for connections to known malicious IPs or unusual domains not typically associated with Plex operations.
• Implement Detections: Utilize the published packet captures to develop and implement robust detection rules within your security infrastructure. Be aware that attackers may modify ports, domains, and filenames, so rely on behavioral indicators rather than fixed indicators alone.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.