Plex2Shell: Hackers Chained Four Plex Media Server Flaws Into Unauthenticated RCE a Day After the PoC Dropped — CISA Ordered Federal Agencies to Patch as Crypto Miners Land on Exposed Servers
Plex2Shell: Hackers Chained Four Plex Media Server Flaws Into Unauthenticated RCE a Day After the PoC Dropped — CISA Ordered Federal Agencies to Patch as Crypto Miners Land on Exposed Servers
A chain of four vulnerabilities in Plex Media Server — collectively called Plex2Shell — is being exploited in the wild to install cryptocurrency miners and a Linux proxy backdoor, one day after a proof-of-concept went public on October 16. CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20 and ordered federal agencies to patch. The bugs were disclosed to Plex on July 27, 2026 by security researcher Zach Main and fixed in Plex Media Server 1.43.3.10861, released August 3 — which means the victims are unpatched, internet-exposed instances, not zero-day casualties.
The chain reads like a checklist of how not to build endpoints. CVE-2026-96652 (CVSS 5.3) is an unauthenticated SSRF via the /player/timeline endpoint, where an unvalidated protocol parameter lets an attacker force the server to POST to a destination of their choice. CVE-2026-96654 (CVSS 6.9) abuses improper neutralization of encoded URI schemes in the searchOne endpoint to call other plugins' functions and steal the owner's admin token. CVE-2026-96655 (CVSS 5.3) is a second SSRF that the now-authenticated attacker — holding that stolen token — uses to fetch arbitrary internal or external addresses through the /video/:/transcode/universal path, such as an attacker-hosted carrier video carrying the payload. CVE-2026-96656 (CVSS 8.6) is external control of file name or path: it writes an attacker-chosen ELF shared object into the Codecs directory and executes it. Chained in order, they deliver unauthenticated remote code execution.
Researcher boredhackerblog documented the follow-on activity: a shell script pulls a miner payload ("x12345") from 217.60.194[.]116 using wget or curl, with attacks observed from IPs including 91.92.40[.]202 and 176.65.139[.]228. Alongside an XMRig miner named "mylovelyminer" — pointed at ota.proxystream[.]st, a domain whose sibling subdomain Bitsight flagged in August in connection with the AISURU DDoS and proxyware botnet — the actors deploy "myawesomeproxy", a stealthy Linux backdoor and reverse proxy whose runtime message tells the whole story: "Running this software on any of your devices makes you agree to the potential external use of your internet traffic." Reddit users report multiple compromised Plex instances carrying the same miner. The KEV deadlines were October 23 for CVE-2026-96654 and CVE-2026-96656 and November 3 for CVE-2026-96652 and CVE-2026-96655.
CISA bundled the order with two other actively exploited flaws: a DLL sideloading bug in Siemens Software Center (CVE-2026-110936, CVSS 8.4) abused in ClickFix attacks through a platform called Romulus, and a command injection flaw in SiteGuard Server Edition (CVE-2026-106931, CVSS 8.5) that its Japanese vendor confirms is under exploitation. The connective tissue is the theme of the month: anything internet-facing with a slow update cadence gets found — media servers included.
What Should You Do?
- Update Plex Media Server to 1.43.3.10861 or later — the fix has existed since August 3. Anything older is KEV-listed and under active attack; there is no reason to run a stale build.
- Stop exposing it if you don't have to — bind the server to a LAN or VPN; if it must face the internet, put real authentication in front of the web endpoints, not just the owner token.
- Hunt for the payloads — processes named mylovelyminer or x12345, unknown ELF files in the Codecs directory, and outbound traffic to proxystream[.]st or 217.60.194[.]116. If found, rebuild the host rather than clean it.
- Treat a media server as an internal foothold — media boxes usually sit on home or office networks with access to file shares. Rotate credentials for anything the server could reach, because proxyware and miners are rarely the only guests.
The WAF Angle
The anatomy here is the classic web exploitation chain — fetch attacker content (SSRF), write it where code loads (path control), execute — the same shape as the Bricksforge upload-to-RCE chain and the image-optimizer flaws in Next.js. Request filtering in front of media endpoints — validating URL parameters and path values — is the pattern that breaks every link in this chain. And the deployment lesson echoes the PoeLLM botnet harvesting forgotten internet-facing services: a media server with powerful defaults and a public IP is infrastructure an attacker will monetize, whether it mines crypto or sells your bandwidth as a proxy.
