Hackers are actively exploiting vulnerabilities in Plex Media Server to deploy cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026.
The activity follows the release of Plex2Shell, a public exploit that chains four vulnerabilities to execute code without authentication. Researchers later observed proxy software running alongside the cryptocurrency miner, indicating that compromised systems may also be abused for additional network activity.
The available evidence confirms successful exploitation of an exposed test server, but does not establish how many real-world Plex servers have been compromised or identify the attackers behind the campaign.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Plex2Shell Chains Four Vulnerabilities
Plex issued security updates on September 1 and urged users to install Plex Media Server 1.43.3 and Plex Desktop 1.115.0. The company warned that users running Plex on network-attached storage systems might need to install updates manually.
The Plex2Shell exploit combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
According to the public exploit repository, the attack begins with server-side request forgery, allowing an attacker to make Plex send chosen requests. The chain then reaches internal functions, obtains access to owner-authorised requests and writes a file to a location selected by the attacker.
The final stage abuses the loading of an unsigned codec to execute code.
The repository identifies Plex versions before 1.43.3.10828 as vulnerable and lists 1.43.3.10861 as fixed. The exploit supports both Linux and Windows, although the observed honeypot activity involved a Linux-based Plex deployment running in Docker.
Honeypot Attack Delivered XMRig Miner
The researcher recorded the first exploitation attempt from the IP address 45.194.92[.]222. Additional attempts involved 91.92.40[.]202 and 176.65.139[.]228.
The requests targeted the /player/timeline/subscribe endpoint and included references to internal Plex services, an sslip.io hostname and the Python-urllib/3.10 user agent.
After outbound network access was enabled, the researcher observed downloads from 217.60.194[.]116 involving files named docker and x.
The collected artifacts included packed and unpacked samples, followed by deployment of an XMRig cryptocurrency miner.
An update to the investigation also identified a process named myawesomeproxy and traffic involving proxystream[.]st. The software displayed a message referring to external use of the device’s internet traffic.
Those observations raise the possibility that compromised Plex systems were also being used as proxies. However, the evidence does not identify the operator of the campaign or establish a connection to a particular botnet.
Administrators Urged to Patch and Review Systems
Plex administrators have been advised to install the latest available release and verify the version running on their systems, particularly on NAS devices and Docker deployments.
On Linux systems, administrators can review Plex process trees for unexpected child processes, suspicious downloads and unfamiliar mining or proxy software. The researcher recommended examining process relationships for signs of compromise.
Packet captures from the observed attacks have also been published to help defenders develop detections. The repository distinguishes files generated during controlled laboratory testing from those associated with live attacks.
Researchers cautioned that attackers can change ports, domains and filenames, meaning that detection methods relying only on fixed indicators may miss future variations of the campaign.
The findings mark a shift from the disclosure of Plex vulnerabilities to observed exploitation involving malware deployment. While the scale of real-world compromise remains unclear, exposed and unpatched Plex servers continue to face increased risk.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
