Plex2Shell Exploits Turn Unpatched Media Servers Into Crypto Miners

Plex2Shell Exploits Turn Unpatched Media Servers Into Crypto Miners

Public Exploit Weaponized Within a Day

Home media servers running Plex are under active attack. On October 16, security researcher Zach Main published a technical write-up and proof-of-concept code for an exploit chain he calls Plex2Shell. Roughly a day later, on October 17, a researcher operating an internet-facing honeypot on an older Plex build watched attackers use that same public code to break in, as reported by Gizmodo and CordCuttersNews. It was the first documented case of in-the-wild exploitation, and it showed how fast a published exploit can be turned against the machines that never got patched.

Four Flaws, No Login Required

Plex2Shell is not a single bug but four vulnerabilities chained together: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. According to The Hacker News, the chain lets an attacker with no valid credentials trick a server into handing over its owner's admin token, then abuse a server-side request forgery flaw in the video transcoding endpoint to fetch an attacker-hosted payload and write a forged codec library to a chosen path. The malicious code runs the next time Plex transcodes a video, with the same privileges as the Plex service itself. A fifth flaw, CVE-2026-96651, was disclosed alongside the four, and the most severe of the set, CVE-2026-96656, carries a CVSS score of 8.6.

A Patch From August That Tens of Thousands Skipped

Main reported the flaws to Plex on July 27, 2026, and the fixed release, version 1.43.3.10861, shipped on August 3, with Plex announcing the fixes publicly on September 1. But patching stalled. Citing Shadowserver Foundation scans, BleepingComputer reported that on September 9, six weeks after the fix, more than 36,000 of roughly 300,000 internet-exposed Plex servers were still running vulnerable versions. When the full proof of concept went public on October 16, many of those machines were still exposed, and exploitation began within about 24 hours, according to SecurityWeek.

Miners Burn the CPU While a Proxy Sells the Connection

The honeypot captured two payloads. Security Affairs reports the first was a cryptocurrency miner built on XMRig, the widely abused open-source Monero miner, which pins the victim's CPU while the machine slows to a crawl. The second payload, appearing later the same day, was a program called myawesomeproxy. The Hacker News notes that running it displays a message saying the operator agrees to "the potential external use" of their internet connection. In practice, it converts the compromised box into a residential proxy node, letting strangers route their traffic through the victim's home connection, a setup SecurityWeek describes as proxy software rented out to make malicious traffic look like ordinary household browsing. Users on Reddit and Neowin have since reported their own servers running hot and slow, confirming the miner infections.

Who Is at Risk and What to Do Now

At risk are servers running versions before 1.43.3.10861 with port 32400 exposed directly to the internet; NAS owners should check versions manually since vendor app-store packages often lag. Plex restated its update guidance on October 19, urging an immediate upgrade to 1.43.3.10861 or later. CordCuttersNews advises operators to look for unexpected child processes of the Plex binary, unfamiliar files in the Codecs directory, and connections to known malicious addresses such as 91.92.40.202, 176.65.139.228, and 45.194.92.222. Anyone who does not need outside access should disable the Remote Access feature rather than leaving the server on the open internet.