Ethical Hacking News
Plex, a popular media server software, has been found to be vulnerable to remote code execution, allowing hackers to mine cryptocurrency and turn users' home internet connections into residential proxies. Despite the company's recommendation to update to the latest version of the software, many users have not taken action, with nearly 49,000 Plex servers still exposed as of Saturday. This vulnerability highlights the need for users to stay up-to-date with their software and to be aware of the potential risks.
Plex, a popular media server software, has a remote code execution vulnerability (Plex2Shell) that allows hackers to mine cryptocurrency and use users' home internet connections as residential proxies. The vulnerability was discovered by security researcher ZM in July 2026 and reported to Plex, but a public warning wasn't issued until September 1st, 2026. A $500 bug bounty was paid to ZM, but it was criticized, and an anonymous blogger found exploit code on ZM's GitHub account that showed the vulnerability was being used to drop crypto miners and residential proxy software. Plex servers are still vulnerable, with nearly 49,000 servers exposed as of Saturday, and many users have not updated to the latest version of the software. The vulnerability highlights the need for users to stay up-to-date with their software and to be aware of the potential risks, especially after recent high-profile security incidents.
Plex, a popular media server software, has been found to be vulnerable to remote code execution, allowing hackers to mine cryptocurrency and turn users' home internet connections into residential proxies. The vulnerability, known as Plex2Shell, was discovered by a security researcher who goes by ZM online and was reported to Plex in July 2026. Despite this, Plex did not issue a public warning until September 1st, 2026, when it posted a public advisory and recommended that users update to the latest version of the software.
The Plex2Shell vulnerability allows an attacker to trick a server into handing over its owner's admin token, allowing them to plant a malicious file that runs every time Plex transcodes a video. This vulnerability is tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Affected servers are those running versions before 1.43.3.10861.
A security researcher who goes by ZM online discovered the vulnerability and reported it to Plex in July 2026. Despite this, Plex did not issue a public warning until September 1st, 2026, when it posted a public advisory and recommended that users update to the latest version of the software. The company also paid a $500 bug bounty to ZM for reporting the vulnerability.
However, the payout was criticized, with multiple users asking whether ZM had forgotten some zeros on the payout amount. An anonymous blogger who runs boredhackerblog set up a honeypot on an old Plex build and saw in-the-wild exploitation using exploit code from ZM's GitHub account. The first payload was a crypto miner, and later the same day, they also saw a tool called myawesomeproxy, which prints a notice that running it means agreeing to "the potential external use of your internet traffic."
The attacker used the vulnerability to drop a crypto miner and residential proxy software that lets other people route their traffic through a victim's home internet connection, essentially using it as a VPN without the victim's knowledge. The blogger reported that the payload sits in Plex's Codecs folder and runs again every time something transcodes, so killing the miner doesn't fix it.
As of Sunday afternoon Eastern time, Plex had not issued any new public statement about the exploit or the attacks that followed it. Despite the company's recommendation to update to the latest version of the software, many users have not taken action, with nearly 49,000 Plex servers still exposed as of Saturday.
Plex has had its fair share of security incidents over the years. In September 2025, Plex told users to reset their passwords after an unauthorized party accessed emails, usernames, and hashed passwords. A month earlier, after a separate bug bounty report, Plex emailed users and told them to update to version 1.42.1. Weeks later, with many servers still vulnerable, it went further.
" As a follow-up to the original report and in an abundance of caution due to a population of servers still on an affected Plex Media Server version (versions 1.41.7.x to 1.42.0.x), we have made adjustments for access to affected servers," Plex wrote. "Specifically, other users to which the server owner has granted access to the server will not be able to connect to it while the server is running an affected version."
However, the company did not apply a similar access restriction, or otherwise require the update, after Plex2Shell became public. Its September 1st notice recommended an update and pointed Windows and Mac users at an optional automatic-update setting. That setting defaults to "Ask me," not to auto-install, and Plex's own support docs say it only applies to Windows and macOS.
Linux, Docker, and NAS installs depend on package managers, container restarts, or manual downloads. Plex's terms of service say the company can require an update "as a means to protect the Plex Solution from unauthorized use, content, or data," and that declining one may cut off access.
A previous LastPass hack also shows that the stakes involved with this kind of vulnerability in Plex server software can be quite high. In 2023, LastPass said attackers got into a senior DevOps engineer's home computer "by targeting the DevOps engineer's home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware."
Ars Technica reported that a person briefed on a private LastPass report identified the package as Plex; however, LastPass and Plex have not publicly confirmed that link in matching detail. Either way, it is the nightmare version of what a vulnerable residential Plex server can become when a remote code execution exploit is discovered.
The crypto giant Coinbase says a decision on Satoshi's coins can wait, while Ledger Announces New Phone-Like Crypto Wallet at the Worst Possible Time. Ledger is also facing increasing scrutiny for how it dealt with earlier reports of backdoored devices months before crypto wallets were drained. The attackers also apparently don't know how to properly hide their tracks with Tornado Cash and Zcash.
Mt. Gox's Disgraced Ex-CEO Finds Redemption Exposing 'Spy Implants' in Ledger Devices. Crypto has dealt with multiple inflation bugs this year, one of the many signs that vulnerabilities found in industry projects are becoming more serious.
Crypto mining and residential proxy software are just the tip of the iceberg, but the Plex vulnerability highlights the need for users to stay up-to-date with their software and to be aware of the potential risks. As ZM said, "Patch your servers!"
Related Information:
https://www.ethicalhackingnews.com/articles/Your-Plex-Server-May-Be-Mining-Crypto-for-Hackers-Without-Your-Knowledge-ehn.shtml
https://gizmodo.com/your-plex-server-could-be-mining-crypto-for-hackers-if-you-havent-updated-it-2000827461
https://nvd.nist.gov/vuln/detail/CVE-2026-96652
https://www.cvedetails.com/cve/CVE-2026-96652/
https://nvd.nist.gov/vuln/detail/CVE-2026-96654
https://www.cvedetails.com/cve/CVE-2026-96654/
https://nvd.nist.gov/vuln/detail/CVE-2026-96655
https://www.cvedetails.com/cve/CVE-2026-96655/
https://nvd.nist.gov/vuln/detail/CVE-2026-96656
https://www.cvedetails.com/cve/CVE-2026-96656/
Published: Mon Oct 19 08:42:41 2026 by llama3.2 3B Q4_K_M
