Active Plex2Shell attacks install miners and Linux proxy malware
Threat actors are exploiting the Plex2Shell vulnerability chain in Plex Media Server to install cryptocurrency miners and a Linux reverse-proxy backdoor. Activity was recorded a day after technical details and a proof of concept for the chain became public on October 16, 2026.
The chain combines four vulnerabilities—CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656—to achieve unauthenticated remote code execution on susceptible instances. Plex patched the reported flaws in Plex Media Server 1.43.3.10861, released on August 3, 2026.
How the Plex2Shell chain reaches code execution
Security researcher boredhackerblog said the first issue, CVE-2026-96652, is an unauthenticated server-side request forgery in the /player/timeline endpoint. The endpoint inserts the protocol parameter into a programmatically constructed player URL without validation, enabling a Plex server to POST to an attacker-selected destination.
CVE-2026-96654 affects the searchOne endpoint. Improper neutralisation of URL values can let an attacker invoke functions in other plugins with chosen parameters and obtain the owner’s administrator token. With that token, CVE-2026-96655 permits requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter.
The final vulnerability, CVE-2026-96656, allows external control of a file name or path. An attacker can place an ELF shared object at a chosen location in the Codecs directory and execute it. The individual CVSS scores cited for the four vulnerabilities are 5.3, 6.9, 5.3 and 8.6 respectively, but their sequence is what enables unauthenticated code execution.
Miner and proxy payloads observed
The observed attacks downloaded a miner payload from the remote host 217.60.194[.]116. Researchers also saw an artifact called myawesomeproxy, which VirusTotal identifies as a stealthy Linux backdoor and reverse proxy. When run, the program states that using it permits potential external use of the device’s internet traffic.
An XMRig process named mylovelyminer was deployed at the same time, with its mining server configured as ota.proxystream[.]st. Bitsight flagged another subdomain under that domain, global.relay.proxystream[.]st, in August 2026 in connection with the AISURU DDoS and proxyware botnet.
Exploitation attempts were observed from 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222. Reddit posts also describe Plex instances compromised with the mylovelyminer payload, although it has not been established whether those cases resulted from exploitation of Plex2Shell.
What administrators should do
Zach Main disclosed the vulnerabilities, including CVE-2026-96651 with a CVSS score of 7.1, to Plex on July 27, 2026. Plex has also urged users to update their installations after addressing multiple unspecified security issues; it remains unclear whether those issues included the vulnerabilities in this chain.
Businesses operating Plex Media Server should inventory exposed and internally reachable instances, update them to version 1.43.3.10861 or a later supported release, and review systems for unexpected XMRig processes, mylovelyminer, myawesomeproxy and suspicious outbound connections. The practical implication is that a media server left behind on patching can be converted into both a cryptomining host and a proxy node through a publicly described attack path.