Hackers Exploit Plex2Shell Vulnerabilities to Deploy Crypto Miners and Linux Backdoor

Active Exploitation of Plex2Shell Chain

Threat actors have begun exploiting a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept went public, according to a researcher who goes by the online alias boredhackerblog. The activity involves chaining four different vulnerabilities, collectively called Plex2Shell.

The Four Vulnerabilities

CVE-2026-96652 (CVSS score 5.3) is an unauthenticated server-side request forgery via the /player/timeline endpoint, where the protocol parameter is inserted into a programmatically constructed player URL with no validation, letting an attacker force the Plex server to POST to a destination of their choice. CVE-2026-96654 (CVSS score 6.9) involves improper neutralization of URL values in the searchOne endpoint, allowing an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token.

CVE-2026-96655 (CVSS score 5.3) is an SSRF flaw that allows an authenticated user, meaning the owner token, to request arbitrary internal or external addresses via the /video/:/transcode/universal path parameter. CVE-2026-96656 (CVSS score 8.6) is an external control of file name or path vulnerability that allows an ELF shared object to be written to an attacker-chosen path in the Codecs directory and executed. Combined in order, the four flaws achieve unauthenticated remote code execution on susceptible Plex Media Server instances.

The vulnerabilities, along with CVE-2026-96651 (CVSS score 7.1), were disclosed to Plex on July 27, 2026, by security researcher Zach Main, and were patched in Plex Media Server 1.43.3.10861 released on August 3, 2026. In-the-wild exploitation was recorded a day after technical details of the chain went public on October 16, 2026.

Miner and Proxy Backdoor Deployed

The attacks led to deployment of a miner payload from a remote server at 217.60.194[.]116. Attack efforts have been observed from the following IP addresses: 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222.

The flaws have also been exploited to deliver an artifact named myawesomeproxy, which VirusTotal identifies as a stealthy Linux backdoor and reverse proxy. Running the program displays a message stating that use of the software implies agreement to the potential external use of the internet traffic. Also deployed concurrently is an XMRig miner process named mylovelyminer, with its mining server pointing to ota.proxystream[.]st. Another subdomain of the same domain, global.relay.proxystream[.]st, was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet.

Posts on Reddit indicate that multiple Plex users have had their instances compromised with the same mylovelyminer payload, though it is not known at this stage if it stems from exploitation of the Plex2Shell flaws. The development comes more than a month after Plex urged users to update their instances following the release of an update addressing multiple unspecified security flaws. It is unclear whether these vulnerabilities were part of that alert. In light of active exploitation, users are advised to keep their Plex installations up to date.

Sources: The Hacker News