Plex2Shell exploit chain is being used against vulnerable Plex Media Servers to install cryptominers and proxy software

TLDR

• Attackers are exploiting Plex2Shell, a four-flaw Plex Media Server chain enabling unauthenticated code execution, within a day of disclosure.²³
• A honeypot researcher first saw attackers drop a cryptominer and proxy software on the morning of 17 October.¹²
• Fixes are in Plex Media Server 1.43.3, and CISA added all four flaws to its KEV catalogue on 20 October.³⁵

Plex2Shell chains four vulnerabilities in Plex Media Server into unauthenticated remote code execution with the privileges of the Plex service.³ The Hacker News lists them as CVE-2026-96652 (CVSS 5.3, an unauthenticated server-side request forgery in the /player/timeline endpoint), CVE-2026-96654 (6.9, a flaw in searchOne that exposes the owner's admin token), CVE-2026-96655 (5.3, a second request forgery in /video/:/transcode/universal) and CVE-2026-96656 (8.6, file path control that lets an attacker write an ELF binary into the Codecs directory and run it).³ It also mentions a fifth flaw disclosed alongside them, CVE-2026-96651 (7.1).³ Researcher Zach Main reported the flaws on 27 July, Plex confirmed them on 4 August and paid a bounty, and his write-up and proof-of-concept went public on 16 October, according to SecurityWeek and The Hacker News.²³ Ars Technica reports that he used AI heavily in the work.⁴

The independent researcher behind the boredhackerblog honeypot says he first saw exploitation on the morning of 17 October.¹ The payloads he captured include an XMRig cryptominer fetched from 217.60.194[.]116 that mines to ota.proxystream[.]st, and a second binary called "myawesomeproxy".¹³ SecurityWeek describes that second payload as proxy software that carries a notice saying running it agrees to external use of the machine's traffic, while The Hacker News says VirusTotal flags it as a stealthy Linux backdoor and reverse proxy.²³ The Hacker News adds that a sibling subdomain of proxystream[.]st was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet.³ Attacking addresses seen in the honeypot were 45.194.92[.]222, 91.92.40[.]202 and 176.65.139[.]228.¹

The indicators cover honeypot activity only, and the researcher says he initially blocked outbound traffic, so the payload data is partial.¹ The Hacker News says Reddit users report the same miner payload but it is not known whether those cases stem from Plex2Shell, and that it contacted Plex for comment.³ Ars Technica says Plex did not respond to its request for comment.⁴

Sources differ on when the fixes shipped. The Hacker News says they are in Plex Media Server 1.43.3.10861, released on 3 August, and that it is unclear whether Plex's September security alert covered these flaws.³ SecurityWeek says Plex announced on 1 September that it had shipped fixes.² Ars Technica writes that the update came "at the start of last month".⁴ The researcher's post says the 1 September alert covered "v1.43.2 and earlier".¹ Ars Technica's advice is to run version 1.43.3 and to restrict servers to the local network or place them behind a reverse proxy rather than exposing them directly to the internet.⁴

Why it matters: a public proof-of-concept and active exploitation within roughly a day mean internet-exposed Plex servers running older builds are being scanned and compromised now, and the observed payloads turn them into cryptominers and traffic-relay nodes.¹²³

Update, 22 October 2026: CISA added all four Plex2Shell flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October, citing evidence of active exploitation.⁵ They are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.⁵ CISA's alert lists the additions but gives no detail on the attacks.⁵ The Hacker News says federal civilian agencies must fix CVE-2026-96656 and CVE-2026-96654 by 23 October and the other two by 3 November, whereas BleepingComputer says agencies must patch or apply mitigations by 23 October without distinguishing between the flaws.⁶⁷

BleepingComputer says the researcher, Zach Main, assigns the full chain a critical score of 9.8, and that the flaws affect Plex Media Server versions before 1.43.3.10861.⁶ It dates that release to 4 August, while The Hacker News dates it to 3 August.⁶⁷ BleepingComputer also says Main published full technical details on 16 October and a proof-of-concept exploit three days later, which differs from the earlier SecurityWeek and Hacker News accounts that put the write-up and proof-of-concept on 16 October.²³⁶ It says reports of in-the-wild exploitation began on 17 October, initially against honeypots that were used to deploy a cryptominer.⁶

The same KEV addition also covered CVE-2026-106931 in SiteGuard Server Edition and CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center that The Hacker News rates CVSS 8.4 and says has been abused in ClickFix attacks using a platform called Romulus.⁵⁷