Ethical Hacking News
Hackers have exploited a chain of vulnerabilities in the Plex Media Server to deploy cryptocurrency miners and a Linux proxy backdoor. The vulnerabilities, collectively known as Plex2Shell, were initially disclosed to Plex on July 27, 2026, and were subsequently patched in Plex Media Server 1.43.3.10861, released on August 3, 2026. However, in-the-wild exploitation attempts targeting the flaws have since been recorded, just a day after the technical details of the Plex2Shell chain went public on October 16, 2026. Users are advised to keep their Plex installations up-to-date for optimal protection against this cyber threat.
Plex Media Server has been identified with a chain of vulnerabilities, collectively known as Plex2Shell, which can be exploited by hackers to deploy cryptocurrency miners and a Linux proxy backdoor. The vulnerabilities, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, can be chained together to achieve unauthenticated remote code execution. Researchers have disclosed the technical details of the vulnerabilities to Plex on July 27, 2026, and the patches were released on August 3, 2026. In-the-wild exploitation attempts have been recorded, just a day after the technical details were made public on October 16, 2026. The attacks have been observed from specific IP addresses and have delivered a stealthy Linux backdoor and reverse proxy. Plex users are advised to keep their installations up-to-date for optimal protection against cyber threats.
In a recent development that has sent shockwaves through the cybersecurity community, researchers have identified a chain of vulnerabilities in the Plex Media Server, a popular media streaming software, which has been exploited by hackers to deploy cryptocurrency miners and a Linux proxy backdoor. The vulnerabilities, collectively known as Plex2Shell, were disclosed to Plex on July 27, 2026, and were subsequently patched in Plex Media Server 1.43.3.10861, released on August 3, 2026. However, in-the-wild exploitation attempts targeting the flaws have since been recorded, just a day after the technical details of the Plex2Shell chain went public on October 16, 2026.
According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, which are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The first vulnerability, CVE-2026-96652, is an unauthenticated server-side request forgery (SSRF) stemming via the "/player/timeline" endpoint, which allows an attacker to force the Plex server to POST to a destination of their choice. The second vulnerability, CVE-2026-96654, is an improper neutralization of URL values included in the "searchOne" endpoint, which could allow an attacker to call other plugins' functions and supply their own parameters to obtain the owner's admin token. The third vulnerability, CVE-2026-96655, is an SSRF vulnerability that allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. The fourth and most critical vulnerability, CVE-2026-96656, is an external control of file name or path vulnerability that allows the ELF shared object to an attacker-chosen path in the Codecs directory and execute it.
When combined together in this order, the vulnerabilities can be used to achieve unauthenticated remote code execution on susceptible Plex Media Server instances. The vulnerabilities were initially disclosed to Plex on July 27, 2026, by security researcher Zach Main, and were subsequently patched in Plex Media Server 1.43.3.10861, released on August 3, 2026. However, in-the-wild exploitation attempts targeting the flaws have since been recorded a day after the technical details of the Plex2Shell chain went public on October 16, 2026.
The attacks have been observed from the following IP addresses - 91.92.40.202, 176.65.139.228, 45.194.92.222, and 176.65.139.228. Furthermore, the vulnerabilities have been exploited to deliver an artifact named "myawesomeproxy," which, according to VirusTotal, is a stealthy Linux backdoor and reverse proxy. Running the program displays the below message, per boredhackerblog - "Running this software on any of your devices makes you agree to the potential external use of your internet traffic."
Also deployed concurrently is an XMRig miner process identified as "mylovelyminer" with its mining server pointing to "ota.proxystream.st." Notably, another subdomain associated with the same domain, "global.relay.proxystream.st," was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet. Posts on Reddit indicate that multiple Plex users have had their instances compromised with the same "mylovelyminer" payload. However, it's not known at this stage if it stems from the exploitation of Plex2Shell flaws.
The development comes more than a month after Plex urged users to update their instances to the latest version following the release of an update that addressed multiple unspecified security flaws. It's unclear if the aforementioned vulnerabilities were part of this alert. In light of active exploitation, users are advised to keep their Plex installations up-to-date for optimal protection.
In conclusion, the exploitation of the Plex2Shell vulnerabilities by hackers has highlighted the importance of keeping software up-to-date and being vigilant in protecting against cyber threats. The vulnerabilities were initially disclosed to Plex on July 27, 2026, and were subsequently patched in Plex Media Server 1.43.3.10861, released on August 3, 2026. However, in-the-wild exploitation attempts targeting the flaws have since been recorded, just a day after the technical details of the Plex2Shell chain went public on October 16, 2026.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Multiple-Vulnerabilities-in-Plex-Media-Server-to-Deploy-Malware-and-Linux-Proxy-Backdoor-ehn.shtml
https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
https://nvd.nist.gov/vuln/detail/CVE-2026-96652
https://www.cvedetails.com/cve/CVE-2026-96652/
https://nvd.nist.gov/vuln/detail/CVE-2026-96654
https://www.cvedetails.com/cve/CVE-2026-96654/
https://nvd.nist.gov/vuln/detail/CVE-2026-96655
https://www.cvedetails.com/cve/CVE-2026-96655/
https://nvd.nist.gov/vuln/detail/CVE-2026-96656
https://www.cvedetails.com/cve/CVE-2026-96656/
Published: Mon Oct 19 14:46:26 2026 by llama3.2 3B Q4_K_M
