# Plex2Shell Vulnerability Turns Media Servers Into Crypto Mining Proxies Unpatched Plex servers are being exploited to host malicious crypto miners and residential proxies. - **Source:** [Gizmodo](https://gizmodo.com/) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0bc3561e-bf1d-48dd-86f1-29e5e6608eae ## Critical Plex2Shell Exploit Chain Plex servers running versions older than 1.43.3.10861 are vulnerable to a four-part remote code execution chain dubbed Plex2Shell. Discovered by researcher ZM, the exploit allows unauthenticated attackers to steal admin tokens and plant malicious files. These files execute automatically whenever the server transcodes video content, creating a persistent security threat. ## Active Exploitation in Wild A security hobbyist operating a honeypot server confirmed active exploitation of the Plex2Shell vulnerability as of October 17th. Attackers are deploying crypto miners and residential proxy software, such as myawesomeproxy. This tool effectively turns the victim's home internet connection into a VPN, allowing malicious actors to route traffic through the server. ## Persistence of Malicious Payloads According to Kraken CSO Nick Percoco, simply killing the crypto miner process is insufficient for remediation. The malicious payload resides within the Plex Codecs folder and re-triggers every time a media file is transcoded. Users must update their software to the latest version to remove the underlying exploit mechanism entirely from their systems. ## Scale of Exposed Infrastructure Data from Shadowserver indicates that nearly 49,000 Plex servers remained vulnerable as of mid-October. This includes approximately 25,100 servers in North America and 17,600 in Europe. Despite public advisories issued on September 1st, the high number of unpatched hosts highlights the significant challenge of maintaining security across diverse home media server deployments. ## Update Challenges and Limitations Plex’s automatic update settings are limited to Windows and macOS, often defaulting to manual prompts rather than silent installs. Linux, Docker, and NAS users must rely on manual package management, which complicates rapid patching. While Plex has the authority to force updates to protect infrastructure, they have not mandated this for the Plex2Shell vulnerability. ## Historical Security Context Plex has faced multiple security incidents, including a 2025 data breach involving hashed passwords and a previous remote code execution flaw tracked as CVE-2025-34158. In that instance, Plex restricted access for users on outdated versions. However, no such access restrictions were implemented following the public disclosure of the more recent Plex2Shell exploit chain. ## High Stakes for DevOps The potential impact of compromised media software is severe, as demonstrated by a 2023 LastPass incident. Reports suggest attackers gained initial access to a senior engineer's home computer by exploiting a vulnerable third-party media package. This allowed for keylogger installation, illustrating how home server vulnerabilities can serve as entry points for enterprise-level attacks. ## Industry Vulnerability Trends The $500 bug bounty paid to ZM for the critical Plex2Shell exploit sparked criticism regarding compensation for high-impact vulnerabilities. This incident reflects broader industry concerns about the severity of bugs in widely used projects. As attackers increasingly target home infrastructure, the gap between vulnerability disclosure and user-side patching remains a critical security bottleneck. ## Sources covering this story - https://gizmodo.com/your-plex-server-could-be-mining-crypto-for-hackers-if-you-havent-updated-it-2000827461 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._