/
← Voltar ao feed
critical

Plex2Shell exploit chain used to turn vulnerable Plex Media Servers into crypto miners and proxy nodes

3 fonte(s) · 3 atualização(ões) · publicado 19/10/2026 14:32 · coletado há 1 dia

Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within about a day of researcher Zach Main publishing technical details and PoC code on October 16, 2026. A researcher running an internet-facing honeypot observed the first in-the-wild exploitation on October 17. The attackers deployed an XMRig-based cryptocurrency miner and later a proxy payload named myawesomeproxy, which turns the host into a proxy node. The chain allows unauthenticated code execution with the privileges of the Plex service. The honeypot data shows exploitation but does not establish how many real-world systems are compromised or who the operators are.

Technical Details

  • Vulnerabilities chained: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
  • The final stage abuses a transcoding-related setting so that Plex loads an attacker-supplied shared library from the codec directory. The loader does not check the library name prefix, execute bit, signature or symbols.
  • Via dlopen, the ELF DT_INIT_ARRAY constructor runs on load. A second transcode triggers re-enumeration of the codec directory, and the constructor runs as the plex user (uid 1000).
  • The honeypot mostly saw scanning and generic attempts before October 17. The researcher had to relax outbound traffic restrictions, so payload capture may be partial, and the attacker may have used modified code.
  • Residential or business IPs running proxy software can be abused to reach services that block suspicious infrastructure, such as corporate VPNs and email.
  • Timeline: Plex was notified July 27, acknowledged August 4 with a bug bounty, and released fixes in September, before the PoC became public.

Remediation

  • Update to Plex Media Server 1.43.3.10861 or later, including on NAS devices, VMs and Docker containers. Prioritize servers exposed to the internet.
  • Investigate unexpected child processes launched by Plex, unexplained CPU usage, unfamiliar files in the Plex Codecs directory, and outbound connections to unrecognized IPs.
  • Do not rely only on fixed IOC lists, since filenames, infrastructure and payloads can change.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 19/10/2026 15:43 · coletado 19/10 17:54

    Plex2Shell exploit chain used to turn vulnerable Plex Media Servers into crypto miners and proxy nodes

    Adds detail on the exploitation mechanism: the loader loads any shared object from the codec directory without checking name, permissions, signature or symbols, so the ELF constructor runs as the plex user. It also adds hunting guidance (unexpected Plex child processes, unfamiliar files in the Codecs directory, odd outbound connections) and notes that the honeypot payload data may be partial.

    ler a análise desta fonte

    Adds detail on the exploitation mechanism: the loader loads any shared object from the codec directory without checking name, permissions, signature or symbols, so the ELF constructor runs as the plex user. It also adds hunting guidance (unexpected Plex child processes, unfamiliar files in the Codecs directory, odd outbound connections) and notes that the honeypot payload data may be partial.

    Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within about a day of researcher Zach Main publishing technical details and PoC code on October 16, 2026. A researcher running an internet-facing honeypot observed the first in-the-wild exploitation on October 17. The attackers deployed an XMRig-based cryptocurrency miner and later a proxy payload named myawesomeproxy, which turns the host into a proxy node. The chain allows unauthenticated code execution with the privileges of the Plex service. The honeypot data shows exploitation but does not establish how many real-world systems are compromised or who the operators are.

    Technical Details

    • Vulnerabilities chained: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
    • The final stage abuses a transcoding-related setting so that Plex loads an attacker-supplied shared library from the codec directory. The loader does not check the library name prefix, execute bit, signature or symbols.
    • Via dlopen, the ELF DT_INIT_ARRAY constructor runs on load. A second transcode triggers re-enumeration of the codec directory, and the constructor runs as the plex user (uid 1000).
    • The honeypot mostly saw scanning and generic attempts before October 17. The researcher had to relax outbound traffic restrictions, so payload capture may be partial, and the attacker may have used modified code.
    • Residential or business IPs running proxy software can be abused to reach services that block suspicious infrastructure, such as corporate VPNs and email.
    • Timeline: Plex was notified July 27, acknowledged August 4 with a bug bounty, and released fixes in September, before the PoC became public.

    Remediation

    • Update to Plex Media Server 1.43.3.10861 or later, including on NAS devices, VMs and Docker containers. Prioritize servers exposed to the internet.
    • Investigate unexpected child processes launched by Plex, unexplained CPU usage, unfamiliar files in the Plex Codecs directory, and outbound connections to unrecognized IPs.
    • Do not rely only on fixed IOC lists, since filenames, infrastructure and payloads can change.
  2. securityweek.com ↗ · pub. 19/10/2026 09:44 · coletado 19/10 17:53

    Plex2Shell exploit chain against Plex Media Server exploited in the wild within a day of PoC release, dropping XMRig and proxy

    Adds first-hand honeypot observation of in-the-wild exploitation starting October 17, the researcher's assessment that attackers want residential IPs as proxies for access to corporate VPNs and email, the caveat that published IOCs reflect only honeypot activity, and the disclosure timeline (bounty August 4, Plex advisory September 1).

    ler a análise desta fonte

    Adds first-hand honeypot observation of in-the-wild exploitation starting October 17, the researcher's assessment that attackers want residential IPs as proxies for access to corporate VPNs and email, the caveat that published IOCs reflect only honeypot activity, and the disclosure timeline (bounty August 4, Plex advisory September 1).

    Threat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, on October 17, 2026, about a day after a researcher published a write-up and PoC on October 16. The chain allows unauthenticated arbitrary code execution with the privileges of the Plex service. A separate researcher observed the attacks on an internet-facing honeypot running a vulnerable release. Attackers dropped an XMRig-based cryptocurrency miner and later a proxy program named myawesomeproxy. The researcher suspects the goal is to harvest residential IP addresses to proxy traffic toward corporate VPNs and email.

    Technical Details

    • Flaws: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, combined to run code without valid credentials.
    • Before October 17 the honeypot saw mostly reconnaissance scans and generic attacks; the exploitation used the public exploit, possibly modified.
    • myawesomeproxy displays a notice that running it implies consent to the use of the host's internet traffic.
    • The researcher cautions that the published IOCs cover only activity seen on the honeypot.
    • Timeline: reported to Plex July 27, confirmed with a bug bounty August 4, fixes announced September 1.

    Remediation

    • Upgrade all Plex Media Server instances to the latest release without delay, as Plex advised in its September advisory.
    • Hunt for the miner and the myawesomeproxy binary on exposed servers.
  3. thehackernews.com ↗ · pub. 19/10/2026 14:32 · coletado 19/10 17:53 primeiro registro

    Plex2Shell exploit chain in Plex Media Server abused to deploy XMRig miner and Linux proxy backdoor

    ler a análise desta fonte

    Threat actors began exploiting the Plex2Shell chain in Plex Media Server a day after technical details and a PoC went public on October 16, 2026. The chain combines four vulnerabilities to achieve unauthenticated remote code execution. Observed attacks deployed an XMRig miner ("mylovelyminer") and a stealthy Linux backdoor and reverse proxy ("myawesomeproxy"). Infrastructure tied to the miner shares a domain with a subdomain that Bitsight flagged in August 2026 in connection with the AISURU DDoS and proxyware botnet. Reddit posts report Plex instances compromised with the same miner payload, but a link to Plex2Shell is not confirmed.

    Technical Details

    • CVE-2026-96652 (CVSS 5.3): unauthenticated SSRF via the /player/timeline endpoint. The protocol parameter is not validated, so the server can be forced to POST to an attacker-chosen destination.
    • CVE-2026-96654 (CVSS 6.9): improper neutralization of URL values in the searchOne endpoint. It allows calling other plugins' functions and obtaining the owner's admin token.
    • CVE-2026-96655 (CVSS 5.3): SSRF for an authenticated (owner token) user via the /video/:/transcode/universal path parameter. It is used to fetch an attacker-hosted carrier video containing a malicious ELF payload.
    • CVE-2026-96656 (CVSS 8.6): external control of file name or path. It writes the ELF shared object to an attacker-chosen path in the Codecs directory and executes it.
    • CVE-2026-96651 (CVSS 7.1) was disclosed and patched alongside these flaws.
    • The miner payload was fetched from 217.60.194[.]116. The miner's mining server is ota.proxystream[.]st. The related subdomain global.relay.proxystream[.]st was linked to AISURU.
    • The "myawesomeproxy" binary is flagged by VirusTotal as a Linux backdoor and reverse proxy. It prints a message stating that running it consents to external use of the device's internet traffic.

    Remediation

    • Update to Plex Media Server 1.43.3.10861 or later, released August 3, 2026, which patches the flaws. Researcher Zach Main reported them to Plex on July 27, 2026.
    • Hunt for the "mylovelyminer" and "myawesomeproxy" artifacts, and for connections to the listed IP and domains.
    • Review unexpected files in the Codecs directory.