Skip to content

Back to the catalog

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
securityweek.comarticle

Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure

Plex2Shell is a chain of four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that gives unauthenticated code execution with the Plex service's privileges. Exploitation began on 17 October 2026, a day after the researcher published a write-up and PoC on 16 October. A honeypot saw an XMRig miner and a proxy tool, myawesomeproxy, dropped. Plex shipped fixes by 1 September 2026.

TL;DR Attackers exploited the Plex2Shell Plex Media Server RCE chain a day after the PoC release, dropping an XMRig miner and a residential proxy tool on a honeypot.
Open original ↗
Document

What it is

Plex2Shell is a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Together they allow arbitrary code execution on an exposed server without valid credentials, running with the Plex service's privileges. The page gives no per-CVE mechanism and no fixed version number.

Timeline

  • 27 July 2026: the finder reports the bugs to Plex.
  • 4 August 2026: Plex confirms them and awards a bug bounty.
  • 1 September 2026: Plex announces fixes are shipped and asks owners to upgrade.
  • 16 October 2026: the finder publishes a write-up and PoC.
  • 17 October 2026: a second researcher's honeypot sees in-the-wild exploitation.

The honeypot ran an internet-facing, vulnerable Plex release. Before 17 October it had drawn mostly reconnaissance scans and generic attack attempts.

What attackers did

The attackers used the public exploit, possibly with tweaks. They dropped an XMRig-based cryptocurrency miner first. Later that day a second program, myawesomeproxy, appeared. The honeypot researcher identified it as proxy software that displays a notice saying anyone running it agrees to the potential use of their internet traffic. The researcher's stated reasoning is that Plex servers often sit on residential IP addresses, which attackers could use as proxies to reach corporate VPNs and email.

What to do

  • Upgrade Plex Media Server to the newest release. Plex's September advisory says to do this without delay, and any server still unpatched on 17 October was exposed to a public exploit.
  • On servers that were internet-reachable and unpatched, look for an unexpected XMRig-based miner and for myawesomeproxy.

Caveats

The researcher warned that the published indicators of compromise cover only activity seen on the honeypot. Other payloads or tooling could exist, so absence of these indicators does not show a server is clean. The page reports the tweak possibility as the researcher's view, not a confirmed finding.

Organisations named here

  • residential proxy

CVEs named here

  • CVE-2026-96652
  • CVE-2026-96654
  • CVE-2026-96655
  • CVE-2026-96656

Technologies named here

  • Plex Media Server
  • Internet-facing Plex honeypot running a vulnerable release
  • Plex2Shell proof-of-concept exploit code
  • Published indicators of compromise
  • XMRig

Techniques named here

  • Cryptocurrency mining with an XMRig-based miner
  • Honeypot monitoring to detect exploitation

Threat actors named here

  • Plex2Shell
  • XMRig-based cryptocurrency miner
  • myawesomeproxy
  • Unnamed threat actors exploiting Plex servers

Related in Threat Intel