How the Plex2Shell Flaw Chain Was Used to Install Crypto Miners on Media Servers

Plex Media Server is software that lets people organize and stream their own movies, TV shows, music and photos to other devices. A set of four flaws in that server, now known as Plex2Shell, has been used in the wild against Plex servers running vulnerable versions.

The bugs were reported to Plex on July 27 and fixed by early autumn, yet attacks began about a day after the public write-up on Oct. 16.

The attacks installed cryptocurrency miners and a proxy program whose launch notice refers to the “potential external use” of the device’s internet traffic. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has since warned that the flaws are being exploited and set a deadline for federal agencies.

What the Four Flaws Do Together

The Hacker News lists four CVEs in the chain: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Individually, three are rated medium severity, with scores of 5.3 to 6.9, and one is rated 8.6. Combined, they allow remote code execution without valid credentials.

The researcher who found them, Zach Main, gives the full chain a critical score of 9.8. The code runs with the same privileges as the Plex service.

The Hacker News reports that a fifth flaw, CVE-2026-96651, rated 7.1, was disclosed in the same batch. It is not one of the four in the chain.

Each bug covers a different stage. The first is an unauthenticated server-side request forgery (SSRF) in the server’s player endpoint, which lets an attacker make the server send requests to destinations of the attacker’s choosing, including the server itself.

Fixed Version
According to BleepingComputer, the Plex2Shell chain affects Plex Media Server versions before 1.43.3.10861. The Hacker News dates the release to Aug. 3, while BleepingComputer gives Aug. 4.

How the Chain Works Step by Step

According to The Hacker News, CVE-2026-96652 (score 5.3) sits in the “/player/timeline” endpoint, where a protocol parameter is inserted into a player URL without validation. That makes the server POST to a location the attacker picks.

In Main’s write-up, those self-originated requests reach a plugin interface that is meant to be reachable only from the same machine. The Hacker News ties an unsanitized identifier there, in the searchOne endpoint, to CVE-2026-96654 (6.9), which lets an attacker call other plugins’ functions with their own parameters.

One plugin function attaches the owner’s admin token to any request whose address merely begins with a local prefix. That allows the token to be sent to a host the attacker controls.

With the stolen token, the attacker is treated as an authenticated user. CVE-2026-96655 (5.3) is an SSRF on the transcoder path that can reach internal or external addresses, such as an attacker-hosted video that carries a malicious ELF payload.

The final flaw, CVE-2026-96656 (8.6), is external control of a file name or path. It writes the payload to a chosen location in the Codecs directory. The transcoder later loads files from that directory as shared libraries, which runs the attacker’s code.

From Private Report to Public Exploit

Main reported the issues to Plex on July 27, 2026. According to SecurityWeek, Plex confirmed the issues and awarded a bug bounty on Aug. 4. Main gives Sept. 23 as the date the CVEs were assigned, and public disclosure came on Oct. 16.

The date of the fix is reported differently. The Hacker News says the patch shipped in Plex Media Server 1.43.3.10861 on Aug. 3. BleepingComputer gives Aug. 4 for the same version. SecurityWeek says Plex announced fixes on Sept. 1 and asked server owners to upgrade.

The Hacker News adds that Plex urged users to update more than a month before its own report, after an update that fixed unspecified flaws, and says it is unclear whether these CVEs were included.

On affected versions, BleepingComputer says servers running anything earlier than 1.43.3.10861 are vulnerable.

SecurityWeek says Main published a write-up and proof-of-concept code on Oct. 16. BleepingComputer says Main published the technical details that day and that a proof-of-concept exploit followed three days later.

A different researcher ran an internet-facing Plex honeypot on a vulnerable release. SecurityWeek reports that before Oct. 17 it mostly drew reconnaissance scans and generic attacks. Exploitation was recorded on Oct. 17, a day after Main’s write-up went public. The Hacker News also puts it about a day after the proof of concept appeared.

Exploitation was recorded on Oct. 17, a day after Main’s write-up went public.

What Attackers Installed

The Hacker News reports that a shell script uses wget or curl to fetch and run a miner, which it names x12345. SecurityWeek describes the miner as built on XMRig, a cryptocurrency mining program.

The attackers also deployed a Linux backdoor and reverse proxy called myawesomeproxy, which The Hacker News says VirusTotal flags as stealthy. On launch it displays a notice that running it means agreeing to the “potential external use” of the device’s internet traffic.

The honeypot researcher suggested to SecurityWeek that such a proxy could let attackers reach corporate VPNs and email through residential IP addresses.

A second miner process, labelled mylovelyminer, was seen running at the same time as the proxy. Its mining server points to a domain under proxystream.st. The Hacker News notes that a related subdomain was flagged by Bitsight in August in connection with the AISURU DDoS and proxyware botnet.

SecurityWeek says the attackers used the public exploit, possibly modified. It also quotes the honeypot researcher’s warning that the published indicators of compromise reflect only what the honeypot saw.

The Hacker News adds that Reddit users have reported compromised Plex servers carrying the mylovelyminer payload. It says it is unknown whether Plex2Shell caused those cases.

The CISA Deadline and What Server Owners Are Told

BleepingComputer, in an Oct. 21 report, says CISA has warned that attackers are “actively exploiting four vulnerabilities in Plex Media Server.” Federal agencies were directed to prioritize patching or apply mitigations by Oct. 23.

BleepingComputer describes the impact as an attacker obtaining the owner’s admin token and running code with elevated privileges. It says the individual flaws are rated medium to high in severity, and that the researcher assigns the full chain a critical score of 9.8.

Plex’s own guidance, in its September advisory as reported by SecurityWeek, is to install the newest Plex Media Server release without delay. The Hacker News contacted Plex and said it would update its report if the company responded.

Main’s write-up says Plex Media Server listens on port 32400 and is often exposed directly to the internet so users can stream remotely.