Attackers began exploiting newly disclosed Plex Media Server flaws almost immediately after public exploit code was released, putting internet-exposed Plex servers at risk. The 'Plex2Shell' chain combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to achieve unauthenticated remote code execution on vulnerable Plex servers. A honeypot saw attackers deploy an XMRig-based cryptominer and 'myawesomeproxy' proxy software after the October 16 disclosure; Plex said fixes had already shipped on September 1.
Why it matters: Anyone running an exposed Plex server may be compromised if they did not install the September fix. This is urgent because real attackers are already using the public exploit chain to hijack systems for mining and proxy abuse, so administrators should update immediately and check for signs of compromise.
info@thehackernews.com (The Hacker News)
2026.10.19
97% relevant
This appears to be a direct update on the same Plex2Shell exploitation event, adding follow-on details that attackers are installing cryptocurrency miners and a Linux proxy backdoor on compromised Plex Media Server systems.
Eduard Kovacs
2026.10.19
100% relevant
This article establishes a distinct story by tying the disclosed Plex2Shell CVEs to confirmed in-the-wild exploitation and observed malware deployment on vulnerable Plex Media Server instances.
← Back to all stories