Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public.
The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. The code runs with the same privileges as the Plex service.
The issues were reported to Plex on July 27, and the company confirmed them and awarded a bug bounty on August 4. On September 1, Plex announced it had already shipped fixes and asked server owners to upgrade.
A different researcher caught the attacks by setting up an internet-facing Plex honeypot running a vulnerable release. Before October 17, the decoy had drawn largely reconnaissance scans and generic attack attempts.
“As of this morning (Oct 17th), I finally saw in the wild exploitation,” the researcher wrote. The attackers used the publicly released exploit, the researcher said, though they may have tweaked the code.
The attackers were observed dropping a cryptocurrency miner built on XMRig. Later that day, a second program called myawesomeproxy also appeared on the honeypot. The researcher identified it as proxy software, and it shows a notice saying that anyone running it agrees to the potential use of their internet traffic.
“Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the researcher wrote.
The researcher cautioned that the published indicators of compromise cover only activity seen on the honeypot.
In its September advisory, Plex recommended that all server owners install the newest release without delay.
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Related: MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Related: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Related: F5, Juniper Networks Patch Critical Vulnerabilities
