Plex2Shell: Plex Media Server exploit chain exploited within a day of PoC to drop XMRig and myawesomeproxy; CISA adds four CVEs to KEV

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 21/10/2026 15:34 · coletado 21/10 16:00

   CISA warns Plex2Shell chain of four Plex Media Server flaws is exploited; Siemens SSC and SiteGuard WAF bugs also added to KEV

   BleepingComputer adds fixed-version details for Siemens Software Center (4.0.9.8) and SiteGuard Server Edition (8.00 Update 5 / 7.00 Update 6), Siemens' October 19 warning and Japan's CERT flag on exploitation, Forescout's description of Romulus, and Main's 9.8 chain score. It also dates the Plex fix to August 4 and describes an October 23 deadline for all Plex2Shell flaws, which differ from earlier reporting.

   ler a análise desta fonte ocultar

   BleepingComputer adds fixed-version details for Siemens Software Center (4.0.9.8) and SiteGuard Server Edition (8.00 Update 5 / 7.00 Update 6), Siemens' October 19 warning and Japan's CERT flag on exploitation, Forescout's description of Romulus, and Main's 9.8 chain score. It also dates the Plex fix to August 4 and describes an October 23 deadline for all Plex2Shell flaws, which differ from earlier reporting.

   CISA warns that attackers are actively exploiting four vulnerabilities in Plex Media Server, collectively named Plex2Shell. Chained, they let an attacker steal the owner's admin token and execute code with elevated privileges. Researcher Zach Main reported the flaws to Plex on July 27 and published full technical details on October 16, followed by a PoC three days later. Exploitation in the wild was reported from October 17, initially against Plex honeypots to deploy a cryptominer. CISA also added a Siemens Software Center flaw (CVE-2026-110936) and a SiteGuard Server Edition WAF flaw (CVE-2026-106931) to the KEV catalog. Federal agencies must patch or mitigate by October 23.

   Technical Details

   • CVE-2026-96652: unauthenticated SSRF in /player/timeline that lets Plex send POST requests to arbitrary destinations, including its own internal APIs.
   • CVE-2026-96654: URL injection in searchOne that allows invoking other plugins' functions with attacker-controlled parameters.
   • CVE-2026-96655: authenticated SSRF in the transcoder endpoint.
   • CVE-2026-96656: arbitrary file write in the transcoder settings that lets administrators plant malicious shared libraries that Plex loads, leading to code execution.
   • The individual flaws are rated medium to high. Main scores the full chain 9.8 (critical).
   • Plex2Shell affects Plex Media Server versions before 1.43.3.10861, which the article says was released on August 4.
   • CVE-2026-110936 (Siemens Software Center, uncontrolled search path element) is exploited in campaigns tied to the multi-payload ClickFix delivery platform Romulus. Siemens warned of this on October 19. Forescout describes Romulus as possibly a private panel, a commercial delivery service, an affiliate framework or shared software.
   • CVE-2026-106931 is an OS command injection in SiteGuard Server Edition. The vendor and Japan's CERT flagged it as exploited late last week.

   Remediation

   • Update Plex Media Server to 1.43.3.10861 or later.
   • Update Siemens Software Center to version 4.0.9.8 or later. Siemens' alert includes IoCs and guidance for identifying compromised systems.
   • Upgrade SiteGuard Server Edition for Apache httpd, Nginx and IIS to 8.00 Update 5, and the FreeBSD edition for Apache httpd and Nginx to 7.00 Update 6 or later.
   • Federal agencies must patch or mitigate Plex2Shell by October 23.
2. thehackernews.com ↗ · pub. 21/10/2026 04:26 · coletado 21/10 05:00

   CISA adds Plex2Shell chain, Siemens Software Center and SiteGuard flaws to KEV after active exploitation

   Compared with the CISA alert summary, this article names the Plex flaws collectively as Plex2Shell and credits Zach Main with discovery and with the finding that they chain into unauthenticated RCE. It states they were fixed in Plex Media Server 1.43.3.10861 on August 3, 2026. It adds that boredhackerblog observed exploitation to deploy cryptocurrency miners and proxy malware, and that the Siemens Software Center flaw has been abused in ClickFix attacks via the Romulus platform. It also reports that EG Secure Solutions confirmed the SiteGuard exploitation, and gives CVSS scores and remediation deadlines of October 23 and November 3, 2026.

   ler a análise desta fonte ocultar

   Compared with the CISA alert summary, this article names the Plex flaws collectively as Plex2Shell and credits Zach Main with discovery and with the finding that they chain into unauthenticated RCE. It states they were fixed in Plex Media Server 1.43.3.10861 on August 3, 2026. It adds that boredhackerblog observed exploitation to deploy cryptocurrency miners and proxy malware, and that the Siemens Software Center flaw has been abused in ClickFix attacks via the Romulus platform. It also reports that EG Secure Solutions confirmed the SiteGuard exploitation, and gives CVSS scores and remediation deadlines of October 23 and November 3, 2026.

   CISA added exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They include four Plex Media Server flaws collectively named Plex2Shell, which researcher Zach Main says can be chained for unauthenticated remote code execution. Researcher boredhackerblog reports that threat actors are weaponizing them to deploy cryptocurrency miners and proxy malware. CISA also flagged a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936), abused in ClickFix attacks via a platform called Romulus, and a command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) that the vendor confirmed as exploited. FCEB agencies must patch three of the CVEs by October 23, 2026 and the rest by November 3, 2026.

   Technical Details

   • CVE-2026-96652 (CVSS 5.3) and CVE-2026-96655 (CVSS 5.3): Plex Media Server SSRF.
   • CVE-2026-96654 (CVSS 6.9): Plex Media Server improper neutralization of encoded URI schemes in a web page.
   • CVE-2026-96656 (CVSS 8.6): Plex Media Server external control of file name or path.
   • The four Plex flaws can be chained by a remote attacker to achieve unauthenticated RCE (Plex2Shell).
   • CVE-2026-110936 (CVSS 8.4): DLL sideloading in Siemens Software Center, abused in ClickFix attacks using Romulus.
   • CVE-2026-106931 (CVSS 8.5): command injection in SiteGuard Server Edition; no further exploitation details are available.
   • Observed post-exploitation payloads on Plex: cryptocurrency miners and proxy malware.

   Remediation

   • Update Plex Media Server to 1.43.3.10861 (released August 3, 2026) or later.
   • FCEB agencies must fix CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by October 23, 2026, and the remaining CVEs by November 3, 2026.
   • Apply vendor fixes for Siemens Software Center and SiteGuard Server Edition; the article does not give version details.
3. cisa.gov ↗ · pub. 20/10/2026 09:00 · coletado 20/10 18:00

   CISA adds six exploited flaws in Plex Media Server, SiteGuard Server Edition and Siemens Software Center to KEV

   ler a análise desta fonte ocultar

   CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Four affect Plex Media Server: CVE-2026-96652 and CVE-2026-96655 (SSRF), CVE-2026-96654 (improper neutralization of encoded URI schemes) and CVE-2026-96656 (external control of file name or path). The other two are CVE-2026-106931, an OS command injection in EG Secure Solutions SiteGuard Server Edition, and CVE-2026-110936, an uncontrolled search path element in Siemens Software Center. CISA calls these vulnerability types a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no exploitation details, threat actor attribution, victim information or IOCs.

   Technical Details

   • CVE-2026-96652 and CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF).
   • CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page.
   • CVE-2026-96656: Plex Media Server External Control of File Name or Path.
   • CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection.
   • CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element.
   • The article does not list affected versions, exploitation methods or the impact of exploitation.

   Remediation

   • Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, and may defer lower-risk vulnerabilities.
   • BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
   • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
   • The article gives no specific patch guidance; consult the Plex, EG Secure Solutions and Siemens vendor advisories.
4. securityaffairs.com ↗ · pub. 19/10/2026 15:43 · coletado 19/10 17:54

   Plex2Shell exploit chain used to turn vulnerable Plex Media Servers into crypto miners and proxy nodes

   Adds detail on the exploitation mechanism: the loader loads any shared object from the codec directory without checking name, permissions, signature or symbols, so the ELF constructor runs as the plex user. It also adds hunting guidance (unexpected Plex child processes, unfamiliar files in the Codecs directory, odd outbound connections) and notes that the honeypot payload data may be partial.

   ler a análise desta fonte ocultar

   Adds detail on the exploitation mechanism: the loader loads any shared object from the codec directory without checking name, permissions, signature or symbols, so the ELF constructor runs as the plex user. It also adds hunting guidance (unexpected Plex child processes, unfamiliar files in the Codecs directory, odd outbound connections) and notes that the honeypot payload data may be partial.

   Attackers began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, within about a day of researcher Zach Main publishing technical details and PoC code on October 16, 2026. A researcher running an internet-facing honeypot observed the first in-the-wild exploitation on October 17. The attackers deployed an XMRig-based cryptocurrency miner and later a proxy payload named myawesomeproxy, which turns the host into a proxy node. The chain allows unauthenticated code execution with the privileges of the Plex service. The honeypot data shows exploitation but does not establish how many real-world systems are compromised or who the operators are.

   Technical Details

   • Vulnerabilities chained: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
   • The final stage abuses a transcoding-related setting so that Plex loads an attacker-supplied shared library from the codec directory. The loader does not check the library name prefix, execute bit, signature or symbols.
   • Via dlopen, the ELF DT_INIT_ARRAY constructor runs on load. A second transcode triggers re-enumeration of the codec directory, and the constructor runs as the plex user (uid 1000).
   • The honeypot mostly saw scanning and generic attempts before October 17. The researcher had to relax outbound traffic restrictions, so payload capture may be partial, and the attacker may have used modified code.
   • Residential or business IPs running proxy software can be abused to reach services that block suspicious infrastructure, such as corporate VPNs and email.
   • Timeline: Plex was notified July 27, acknowledged August 4 with a bug bounty, and released fixes in September, before the PoC became public.

   Remediation

   • Update to Plex Media Server 1.43.3.10861 or later, including on NAS devices, VMs and Docker containers. Prioritize servers exposed to the internet.
   • Investigate unexpected child processes launched by Plex, unexplained CPU usage, unfamiliar files in the Plex Codecs directory, and outbound connections to unrecognized IPs.
   • Do not rely only on fixed IOC lists, since filenames, infrastructure and payloads can change.
5. securityweek.com ↗ · pub. 19/10/2026 09:44 · coletado 19/10 17:53

   Plex2Shell exploit chain against Plex Media Server exploited in the wild within a day of PoC release, dropping XMRig and proxy

   Adds first-hand honeypot observation of in-the-wild exploitation starting October 17, the researcher's assessment that attackers want residential IPs as proxies for access to corporate VPNs and email, the caveat that published IOCs reflect only honeypot activity, and the disclosure timeline (bounty August 4, Plex advisory September 1).

   ler a análise desta fonte ocultar

   Adds first-hand honeypot observation of in-the-wild exploitation starting October 17, the researcher's assessment that attackers want residential IPs as proxies for access to corporate VPNs and email, the caveat that published IOCs reflect only honeypot activity, and the disclosure timeline (bounty August 4, Plex advisory September 1).

   Threat actors began exploiting Plex2Shell, a chain of four Plex Media Server vulnerabilities, on October 17, 2026, about a day after a researcher published a write-up and PoC on October 16. The chain allows unauthenticated arbitrary code execution with the privileges of the Plex service. A separate researcher observed the attacks on an internet-facing honeypot running a vulnerable release. Attackers dropped an XMRig-based cryptocurrency miner and later a proxy program named myawesomeproxy. The researcher suspects the goal is to harvest residential IP addresses to proxy traffic toward corporate VPNs and email.

   Technical Details

   • Flaws: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, combined to run code without valid credentials.
   • Before October 17 the honeypot saw mostly reconnaissance scans and generic attacks; the exploitation used the public exploit, possibly modified.
   • myawesomeproxy displays a notice that running it implies consent to the use of the host's internet traffic.
   • The researcher cautions that the published IOCs cover only activity seen on the honeypot.
   • Timeline: reported to Plex July 27, confirmed with a bug bounty August 4, fixes announced September 1.

   Remediation

   • Upgrade all Plex Media Server instances to the latest release without delay, as Plex advised in its September advisory.
   • Hunt for the miner and the myawesomeproxy binary on exposed servers.
6. thehackernews.com ↗ · pub. 19/10/2026 14:32 · coletado 19/10 17:53 primeiro registro

   Plex2Shell exploit chain in Plex Media Server abused to deploy XMRig miner and Linux proxy backdoor

   ler a análise desta fonte ocultar

   Threat actors began exploiting the Plex2Shell chain in Plex Media Server a day after technical details and a PoC went public on October 16, 2026. The chain combines four vulnerabilities to achieve unauthenticated remote code execution. Observed attacks deployed an XMRig miner ("mylovelyminer") and a stealthy Linux backdoor and reverse proxy ("myawesomeproxy"). Infrastructure tied to the miner shares a domain with a subdomain that Bitsight flagged in August 2026 in connection with the AISURU DDoS and proxyware botnet. Reddit posts report Plex instances compromised with the same miner payload, but a link to Plex2Shell is not confirmed.

   Technical Details

   • CVE-2026-96652 (CVSS 5.3): unauthenticated SSRF via the /player/timeline endpoint. The protocol parameter is not validated, so the server can be forced to POST to an attacker-chosen destination.
   • CVE-2026-96654 (CVSS 6.9): improper neutralization of URL values in the searchOne endpoint. It allows calling other plugins' functions and obtaining the owner's admin token.
   • CVE-2026-96655 (CVSS 5.3): SSRF for an authenticated (owner token) user via the /video/:/transcode/universal path parameter. It is used to fetch an attacker-hosted carrier video containing a malicious ELF payload.
   • CVE-2026-96656 (CVSS 8.6): external control of file name or path. It writes the ELF shared object to an attacker-chosen path in the Codecs directory and executes it.
   • CVE-2026-96651 (CVSS 7.1) was disclosed and patched alongside these flaws.
   • The miner payload was fetched from 217.60.194[.]116. The miner's mining server is ota.proxystream[.]st. The related subdomain global.relay.proxystream[.]st was linked to AISURU.
   • The "myawesomeproxy" binary is flagged by VirusTotal as a Linux backdoor and reverse proxy. It prints a message stating that running it consents to external use of the device's internet traffic.

   Remediation

   • Update to Plex Media Server 1.43.3.10861 or later, released August 3, 2026, which patches the flaws. Researcher Zach Main reported them to Plex on July 27, 2026.
   • Hunt for the "mylovelyminer" and "myawesomeproxy" artifacts, and for connections to the listed IP and domains.
   • Review unexpected files in the Codecs directory.