THREAT actors are actively exploiting a chain of Plex Media Server flaws, collectively dubbed Plex2Shell, to install crypto miners and a Linux proxy backdoor. In-the-wild activity follows a public PoC and chains four vulnerabilities to achieve unauthenticated remote code execution on vulnerable Plex installations.
The flaws are CVE-2026-96652 (unauthenticated SSRF via /player/timeline), CVE-2026-96654 (improper neutralization of URL values in searchOne that could allow plugin function calls and owner admin token exposure), CVE-2026-96655 (SSRF enabling arbitrary internal/external addresses via /video/:/transcode/universal), and CVE-2026-96656 (external control of file name/path enabling execution of an ELF payload). All four were disclosed to Plex on 27 July 2026 by Zach Main and patched in Plex Media Server 1.43.3.10861, released on 3 August 2026.
Exploitation activity has been observed days after technical details were made public (18–19 October 2026 UK time). At least two malicious payloads have been tied to these campaigns: a cryptocurrency miner process named “mylovelyminer” (mining server: ota.proxystream[.]st) and an ELF-backed Linux proxy/backdoor named “myawesomeproxy.” The backdoor reportedly presents a message about external use of traffic when run.
Reported command-and-control indicators include the miner payload appearing on multiple Plex hosts and activity traced to IPs such as 91.92.40.x, 176.65.139.x, and 45.194.92.x. A separate artefact under the same campaign is described as a stealthy Linux backdoor/reverse proxy in VirusTotal, with ties to a proxystream domain and related subdomains.
Plex users are urged to update to the patched version (1.43.3.10861) and to monitor for accompanying artefacts and miner activity. The researchers note ongoing exploitation and suggest applying the Plex security update promptly to mitigate unauthenticated remote code execution under Plex2Shell.