Plex vulnerabilities being exploited in the wild to drop a cryptominer

What it is

A honeypot operator's account of the first in-the-wild exploitation of the Plex2Shell chain against Plex Media Server, observed on 17 October 2026. The chain is CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The payload seen was an XMRig cryptominer, and a proxyware sample followed later the same day. Plex announced security updates for Media Server v1.43.2 and earlier on 1 September 2026. The researcher who found the chain, code-zm, published the write-up and exploit code on 16 October 2026.

How it works

The first observed request was a GET to /player/timeline/subscribe. Its protocol parameter pointed back at the server's own http://127.0.0.1:32400/system/agents/z/searchOne. The identifier was com.plexapp.agents.thetvdb/function/GetResultFromNetwork with a url parameter. That URL was http://127.0.0.1.45-194-92-222.sslip.io:8952/TKN_...#, so the server was made to fetch from a hostname that embeds the attacker's IP. The client was Python-urllib/3.10 and the client identifier began poc_. After outbound traffic was allowed on the honeypot, the server downloaded a file named docker and a UPX-packed binary x from 217.60.194.116. The page says x is the miner.

What to do

Block or hunt for these indicators (all from this one honeypot).

Exploitation sources: 45.194.92.222, 91.92.40.202, 176.65.139.228. Download host: 217.60.194.116.

5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441  docker
68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7  x (UPX packed)
b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49  x (UPX unpacked)
e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9  myawesomeproxy
2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db  xmrig

For detection, the page points to three sources:

• Lab pcaps at github.com/BoredHackerBlog/plex2shell_pcap.
• The original researcher's detections at github.com/code-zm/plex2shell/tree/main/detection.
• Artifacts the author uploaded to GitHub (no link is given on the page).

Treat any Plex server on v1.43.2 or earlier as exposed, and check for the timeline/subscribe pattern above and for outbound connections to the listed hosts. The page does not name a fixed version.

Caveats

• The honeypot blocked outbound traffic by default. The author changed this partway through, so payload capture is partial and the author had not yet reviewed the pcaps.
• Attackers may use modified code or techniques, so the request pattern may not be exhaustive.
• The proxyware myawesomeproxy was not analysed by the author. It prints a notice that running it allows external use of the device's internet traffic. Traffic to proxystream.st suggests a link to the Aisuru botnet reporting from Bitsight, which is the author's inference from sandbox traffic and a similar sample, not a confirmed attribution.
• The author's concern is that Plex servers on residential IPs could be used as proxies to reach corporate VPNs and email. This is their expectation, not an observed outcome.
• The IOC list on the page repeats 176.65.139.228 and has no timestamps beyond 17 October 2026.