Key points
- The Plex2Shell exploit chains four vulnerabilities to execute code without authentication.
- Researchers observed successful attacks against a Linux-based Plex honeypot on October 17, 2026.
- Plex released security updates in September 2026 to address these critical flaws.
Threat actors are actively exploiting vulnerabilities in Plex Media Server to install cryptocurrency mining malware, according to Cyber Security News. A researcher recorded successful attacks against a honeypot on October 17, 2026, confirming that the public Plex2Shell exploit is being used in the wild to compromise exposed servers.
The attack leverages a chain of four vulnerabilities to run code without requiring login credentials. The exploit, known as Plex2Shell, combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. This sequence allows attackers to bypass authentication and execute arbitrary commands on the target system, leading to the deployment of malicious software.
Exploit Mechanics and Payloads
The Plex2Shell repository details how the attack progresses from initial access to full compromise. It begins with a server-side request forgery that tricks the server into sending attacker-chosen requests. This leads to accessing internal functions and owner-authorized requests, allowing the attacker to write files to specific locations. The final stage abuses the loading of an unsigned codec to execute code, resulting in the installation of XMRig mining software and proxy tools.
Affected Environments and Versions
The exploit targets Plex Media Server versions prior to 1.43.3.10828, with version 1.43.3.10861 identified as fixed. Although the exploit supports both Linux and Windows targets, the reported honeypot activity involved a Linux-based Plex deployment running in Docker. Plex announced security updates on September 1, 2026, urging users to install Plex Media Server 1.43.3 and Plex Desktop 1.115.0.
Next steps
Organizations should verify that their Plex Media Server installations are updated to at least version 1.43.3.10861. NAS users may need to install these updates manually, as noted in Plex's official security notice. Teams should also review outbound traffic logs for connections to known malicious domains or IPs associated with the observed campaigns, such as proxystream[.]st.
Signals worth monitoring
Security operations teams should monitor for unusual outbound connections from media server hosts, particularly those initiating downloads of executable files or connecting to unknown proxy services. Look for processes with generic or misleading names running alongside the main application. Check for unexpected file writes in temporary directories or locations where unsigned codecs might be loaded. Investigate any server-side request forgery attempts targeting internal endpoints, as these often precede unauthorized code execution.
Background: Honeypots
Honeypots are decoy systems that attract attackers to reveal their methods. They provide high-fidelity data on intrusion attempts but create significant operational noise. You must isolate them from production networks and integrate their alerts into your broader detection strategy to avoid alert fatigue.
Read the full guide: Honeypots: 9 FAQs on Deployment, Detection and Data Quality
What to do and how to stay safe: Plex
- Verify that all Plex Media Server instances are updated to the latest patched version.
- Monitor network traffic for unusual outbound connections from media server hosts.
- Review process lists for unknown or suspicious executables running on affected systems.
- Restrict outbound traffic from media servers to only necessary destinations.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What vulnerabilities does the Plex2Shell exploit chain use?
It chains CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to execute code without authentication.
Which versions of Plex Media Server are vulnerable to this attack?
Versions before 1.43.3.10828 are vulnerable, while version 1.43.3.10861 is considered fixed.
What malware is being deployed through this exploit?
Attackers are deploying XMRig cryptocurrency mining malware and proxy software named myawesomeproxy.
