THREAT actors have weaponised a four‑CVE chain known as Plex2Shell against exposed Plex Media Server installations only hours after technical details and a working exploit were disclosed. The bugs, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can be chained to achieve arbitrary code execution on a server that runs Plex without valid credentials.
The flaws were reported to Plex in July and acknowledged with a bug bounty; Plex released fixes and urged users to upgrade by early September. A researcher set up an internet‑facing honeypot running a vulnerable release and began seeing exploitation in the wild by October 17. The attackers reportedly used the public exploit, albeit with possible tweaks to the code, to break into exposed servers and drop a cryptocurrency miner built on XMRig, followed later by a second program described as proxy software.
Security researchers noted the two payloads after initial compromise: a miner and a proxy that appears to route user traffic and includes a notice about possible interception of internet traffic. The honeypot observations suggest that the proxy component could enable threat actors to use residential IPs for broader access, potentially facilitating access to corporate VPNs and emails.
However, the indicators of compromise cited by the researcher reflect activity seen on the honeypot environment rather than a comprehensive set of in‑the‑wild signals. Plex had already advised operators to upgrade to the latest release, and the public exploitation underlines the importance of applying patches promptly to exposed Plex servers.