ATTACKERS are leveraging a four‑vulnerability chain, disclosed as Plex2Shell, to compromise exposed Plex Media Server instances and deploy cryptocurrency mining and proxy payloads. The chain combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to achieve arbitrary code execution without credentials.
The vulnerability chain is triggered by Plex loading untrusted shared libraries, with the loader not validating library names, execute permissions, signatures, or symbols; the constructor in a loaded ELF can run and execute code with the Plex service’s privileges. Researchers report that the final stage can run during transcoding, allowing a crafted library to execute on Plex load and provide code execution under the Plex user account (uid=1000), enabling attackers to install further software or move laterally.
Public activity began after researcher Zach Main published technical details on 16 October 2026, with exploitation observed on an internet‑facing honeypot within 24 hours. The initial payload identified was an XMRig cryptocurrency miner; a second payload named myawesomeproxy was also seen, turning compromised hosts into proxy nodes that could route traffic through residential or business connections. Plex had notified the vendor on 27 July and released fixes in September 2026, prior to public PoC code.
The recommended immediate mitigation is to update to Plex Media Server 1.43.3.10861 or later, including installations on NAS devices, VMs, and Docker containers, and to investigate unusual child processes, CPU spikes, unfamiliar files in the Plex Codecs directory, or outbound connections to unknown IPs. The article cautions that not all affected systems have demonstrably been compromised and urges patching and exposure checks rather than assuming widespread exploitation.