Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Original title: Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
Attackers are using the public Plex2Shell chain against unpatched Plex Media Server systems exposed on port 32400. The four flaws let a remote user run code without a password, with the rights of the Plex service. A honeypot saw exploitation on October 17, one day after the proof of concept was published, dropping an XMRig-based Monero miner and a Linux proxy called myawesomeproxy. Plex fixed the bugs in 1.43.3.10861 or newer; updating does not remove an already installed payload.
Unconfirmed: How many real servers were hit is unknown; The Hacker News links the miner domain to the AISURU botnet.
- CVEs are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
- Zach Main reported the bugs on July 27; Plex paid a bounty on August 4.
- Payloads were fetched from 217.60.194[.]116.
- QNAP says some NAS users were breached.
- CISA listed all four flaws as known exploited on October 20.
Impact: Remote code execution as the Plex service, then miners
| Product | Affected | Fixed in |
|---|---|---|
| Plex Media Server | unpatched | 1.43.3.10861 or newer |
- 1.Update to Plex Media Server 1.43.3.10861 or newer and confirm the reported version.
- 2.Treat an exposed server as compromised, reinstall cleanly, and reset credentials.
- 3.Stop forwarding port 32400 unless needed; otherwise use a VPN.
- Vendors
- Plex
- Products
- Plex Media Server
- Malware
- XMRigmyawesomeproxyAISURU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |
From the original article
3 min read at cybersecuritynews.com
Hackers are now using a public exploit chain called Plex2Shell to break into unpatched Plex Media Server systems and install cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit code went public on October 16, 2026. Plex2Shell links four flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.