Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun exploiting a chain of vulnerabilities in Plex Media Server, collectively dubbed "Plex2Shell," to deploy cryptocurrency miners and a stealthy Linux reverse proxy/backdoor — just one day after a public proof-of-concept (PoC) was released. The in-the-wild activity was documented by a security researcher using the alias "boredhackerblog," who runs a honeypot that captured attacker traffic starting the morning of October 17, 2026. The underlying flaws were originally reported to Plex by researcher Zach Main on July 27, 2026, and patched by the vendor in the weeks that followed — but the October 16 publication of technical details and working exploit code triggered immediate, automated attacks against unpatched, internet-exposed servers.

Plex Media Server is widely self-hosted by home users and small organizations to stream personal media libraries, and a large population of installations are reachable directly from the internet — a combination that made Plex2Shell an attractive target for opportunistic cryptomining and proxyware operators the moment a working exploit became public.

Details

What Happened

Zach Main privately disclosed the Plex2Shell vulnerability chain to Plex on July 27, 2026; Plex confirmed the issues and awarded a bug bounty on August 4, and shipped fixes across its release channel by September 1, 2026, urging "all server owners [to] install the newest release without delay." For six weeks, the flaws sat patched but largely unremarked upon outside the disclosure process.

That changed on October 16, 2026, when the researcher published a full technical write-up and working proof-of-concept for the exploit chain on boredhackerblog.info. Within roughly 24 hours — "as of this morning (Oct 17th)," in the researcher's words — honeypot sensors began recording genuine in-the-wild exploitation attempts, a sharp escalation from the reconnaissance scans and generic, untargeted attack traffic the honeypot had absorbed beforehand. The researcher noted that attackers appeared to be using the published exploit largely as-is, with at most minor modifications, and cautioned that the indicators shared publicly reflect only activity observed on that single honeypot — real-world exploitation volume is likely broader.

Two distinct payload families were dropped on compromised hosts. The first, an XMRig-based cryptocurrency miner, phoned home to a mining pool at ota.proxystream[.]st. The second, delivered later the same day, was a program the researcher named "myawesomeproxy" — software that displays a notice indicating that anyone running it consents to potential external use of their internet connection, consistent with proxyware that resells a victim's bandwidth and IP reputation to third parties. A related subdomain, global.relay.proxystream[.]st, has previously been linked to the AISURU DDoS and proxyware botnet, which was independently flagged by researchers in August 2026.

The Exploit Chain

The Plex2Shell chain links four of the disclosed flaws sequentially to achieve unauthenticated remote code execution against an internet-exposed Plex Media Server:

1. Unauthenticated SSRF (CVE-2026-96652) — The /player/timeline endpoint inserts an attacker-controlled protocol parameter into a programmatically constructed player URL with no validation, letting an attacker force the Plex server to issue an outbound POST request to a destination of their choosing — with no login required.
2. Admin token theft (CVE-2026-96654) — Improper neutralization of URL values in the searchOne endpoint allows an attacker to invoke other plugins' functions with attacker-supplied parameters, ultimately leaking the server owner's admin token.
3. Authenticated SSRF (CVE-2026-96655) — Armed with the stolen owner token, the attacker abuses the /video/:/transcode/universal path parameter to make the server request an arbitrary internal or external address — in observed attacks, a remote video file carrying a malicious ELF payload.
4. Arbitrary file write and execution (CVE-2026-96656) — External control over a file name/path lets the attacker write that ELF payload into the server's Codecs directory and trigger its execution, completing the chain with code running under Plex's own service privileges.

Observed infrastructure tied to the live attacks included source IP addresses 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222, with payload staging traced to 217.60.194[.]116. Post-exploitation, attackers used simple shell commands — wget/curl calls inside dropped scripts — to retrieve and launch the miner and proxy binaries.

Impact Assessment

Recommendations

For Plex Server Admins

• Update Plex Media Server to 1.43.3.10861 or later immediately — this is the single most effective mitigation, since the exploit chain cannot function against a patched build.
• Audit the Codecs directory and the server's running process list for unfamiliar binaries, especially anything resembling XMRig or an unrecognized proxy/relay executable.
• Check outbound network connections for traffic to proxystream[.]st subdomains or the IP addresses listed above, which indicate active compromise rather than mere exposure.
• If the server has not yet been patched and shows no signs of compromise, consider temporarily removing it from direct internet exposure (placing it behind a VPN or reverse proxy with authentication) until the update is confirmed applied.

For IT/Security Teams

• Treat any Plex Media Server discovered on the network perimeter as a priority patch target — this is a now-public, low-complexity, unauthenticated RCE chain with confirmed in-the-wild exploitation.
• Add the published IOCs (source IPs 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222; payload host 217.60.194[.]116; domains under proxystream[.]st) to detection and blocking rules, while recognizing the researcher's caveat that this list reflects one honeypot's visibility, not the full scope of attacker infrastructure.
• Monitor for anomalous CPU utilization and unexpected outbound connections on any host running Plex, which are the most visible symptoms of both the cryptominer and the proxy backdoor.
• Flag Plex2Shell in vulnerability management tooling and cross-reference exposed assets against the CVE set (CVE-2026-96651, -96652, -96654, -96655, -96656) to confirm patch status fleet-wide.

For Home Users and Self-Hosters

• If you run Plex on a home server or NAS, confirm auto-update is enabled or manually trigger an update now — Plex's own guidance has urged immediate upgrades since September.
• Avoid port-forwarding the Plex server directly to the internet when possible; use Plex's Relay feature or a VPN instead to reduce exposure to opportunistic scanning.
• Watch for signs of compromise such as fans running constantly, degraded streaming performance, or unexplained bandwidth usage, which can indicate an active miner or proxy process.

Key Takeaways

1. The Plex2Shell chain combines five related CVEs (CVE-2026-96651, -96652, -96654, -96655, -96656) to achieve unauthenticated remote code execution against Plex Media Server versions prior to 1.43.3.10861.
2. Although Plex patched the flaws by September 1, 2026, mass exploitation only began after researcher Zach Main's technical write-up and PoC went public on October 16, with confirmed attacks observed roughly 24 hours later.
3. Attackers are deploying two payload types: an XMRig-based cryptocurrency miner and a Linux reverse proxy/backdoor ("myawesomeproxy") that can route a victim's internet traffic for third-party use.
4. A proxy-related domain in the attack infrastructure has been linked to the AISURU DDoS/proxyware botnet, suggesting compromised Plex servers may feed into a larger criminal operation beyond simple cryptomining.
5. Patching remains the only complete fix — the exploit chain requires no credentials and cannot be meaningfully mitigated short of updating or removing the server from direct internet exposure.
6. The incident underscores a recurring pattern: public PoC releases for self-hosted, internet-exposed software are weaponized within hours by automated, opportunistic attackers, not just sophisticated threat groups.

Sources

• Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor — The Hacker News
• Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure — SecurityWeek
• Plex2Shell research and honeypot findings — boredhackerblog