Hackers Exploit Plex2Shell Vulnerabilities to Deploy Miners and Backdoors
Attackers are chaining four Plex Media Server flaws to install unauthorized proxy software.
1Plex2Shell Vulnerability Chain
Threat actors are actively exploiting a chain of four vulnerabilities, collectively termed Plex2Shell, within Plex Media Server. This exploit sequence allows for unauthenticated remote code execution on susceptible instances. The chain includes CVE-2026-96651, which carries a CVSS score of 7.1. These flaws were originally disclosed to Plex on July 27, 2026.
2Rapid Exploitation Timeline
Technical details and a proof-of-concept for the Plex2Shell chain were made public on October 16, 2026. Within twenty-four hours, security researchers observed in-the-wild exploitation attempts targeting these specific flaws. Attackers are leveraging these vulnerabilities to deploy malicious payloads directly from remote servers, specifically identifying the IP address 217.60.194.116 as a source.
3Malicious Proxyware Deployment
The attack sequence delivers a stealthy Linux backdoor and reverse proxy artifact named myawesomeproxy. This program forces users to agree to potential external use of their internet traffic upon execution. VirusTotal analysis confirms the malicious nature of this artifact, which functions as a persistent backdoor within the compromised Plex Media Server environment.
4XMRig Miner Integration
Attackers concurrently deploy an XMRig miner process identified as mylovelyminer. This process connects to a mining server at ota.proxystream.st. The infrastructure is linked to the AISURU DDoS and proxyware botnet, as previously flagged by Bitsight in August 2026. This indicates a coordinated effort to monetize compromised server resources through illicit cryptocurrency mining.
5Widespread User Impact
Reports from Reddit confirm that multiple Plex users have identified the mylovelyminer payload on their compromised instances. While the exact correlation between these specific user reports and the Plex2Shell exploit remains under investigation, the presence of the identical miner suggests a systematic campaign targeting the Plex ecosystem. Users are reporting unauthorized resource consumption.
6Patching and Mitigation Status
Plex released a security update, version 1.43.3.10861, on August 3, 2026, which addressed the identified vulnerabilities. Despite this, many instances remain unpatched and vulnerable to exploitation. Plex had previously urged users to update their software over a month ago, though it remains unclear if those earlier alerts specifically covered these four flaws.
7Infrastructure Security Risks
The exploitation of media server software highlights the risks associated with unpatched remote access services. By chaining vulnerabilities, attackers bypass authentication mechanisms to gain full control over the underlying Linux host. This allows for the installation of persistent backdoors, enabling long-term access for data exfiltration or further lateral movement within the network.
8Urgent Security Recommendations
Given the active exploitation of the Plex2Shell chain, administrators must ensure their Plex installations are updated to version 1.43.3.10861 or later immediately. Monitoring network traffic for connections to known malicious domains like proxystream.st is essential. Organizations should prioritize patching internet-facing services to mitigate the risk of remote code execution and botnet recruitment.