Plex2Shell exploit chain used to turn vulnerable Plex Media Servers into crypto miners and proxy nodes
Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within about a day of researcher Zach Main publishing technical details and PoC code on October 16, 2026. A researcher running an internet-facing honeypot observed the first in-the-wild exploitation on October 17. The attackers deployed an XMRig-base…