Terminal2Shell ‘zero-day’ is satire, not a confirmed flaw
Opening a terminal as a signed-in user is ordinary behavior, and the claimed CVSS 11.0 exceeds the official scale.
1
Stories per day · 30 days
3 RSS
Relatedkev9cryptominer7plex2shell7ssrf6cisa5xmrig5qnap3siemens3siteguard3litellm2nas2nodejs2supply-chain2arbitrary-file-write1bod-26-041brotli1cisa-kev1command-injection1
16 stories, newest first · one card per story
Stories tagged #plex
Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
1
Weekly recap: PHP2Shell scans, Plex2Shell attacks, LiteLLM supply chain
CISA listed four exploited Plex flaws, while a leaked LiteLLM key led to a malicious Python package release.
PHP, Node.js, LiteLLM and an Indian CA hit in one day
NSA told PHP users to update or go offline; LiteLLM malicious packages stole credentials and included a RAT.
CISA says attackers chain Plex flaws in Plex2Shell server breaches
Federal agencies must patch or mitigate by October 23; honeypots were hit with a cryptominer.
CISA Orders Patch for Exploited Plex2Shell, Siemens and SiteGuard Flaws
CISA added four Plex2Shell vulnerabilities and two other exploited flaws to its KEV catalog, ordering federal agencies to patch them by October 23 and November 3, 2026.
CISA adds six exploited vulnerabilities to the KEV catalog
The entries cover four Plex Media Server bugs, SiteGuard command injection, and a Siemens path flaw.
CISA adds Plex Media Server SSRF to KEV (CVE-2026-96652)
Any X-Plex-Token can force a POST via /player/timeline on builds before 1.43.3.10861; the due date is November 3.
Fixed Plex Media flaws exploited to install malware
The public chain uses unauthenticated SSRF, a loopback pivot, and token theft to run a payload.
Attackers use Plex2Shell to mine crypto on vulnerable Plex servers
A public proof of concept for four Plex flaws was used within a day to drop XMRig and proxy software on a honeypot.
2
Attackers exploit Plex2Shell flaws to install miners and a proxy
Four chained bugs give unauthenticated remote code execution; Plex fixed them in 1.43.3.10861 on August 3.
8
Plex Media Server flaws exploited in the wild to drop a miner
A honeypot saw RCE attempts from three IPs, then a miner and a proxy called myawesomeproxy.
2
Plex2Shell chain used against Plex servers a day after disclosure
A honeypot saw the public exploit drop an XMRig miner and later proxy software called myawesomeproxy.
4
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
4
Over 36,000 exposed Plex servers vulnerable to recent flaws
Over 36,000 internet-exposed Plex Media Server instances remain unpatched against recently disclosed vulnerabilities, leaving them open to attack.
Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.
1