Plex Exploit Chain Used Against Vulnerable Servers a Day After Disclosure

Summary

Attackers used the publicly released Plex2Shell exploit against a vulnerable honeypot a day after disclosure, running code without valid credentials and dropping an XMRig miner and proxy software. Plex had already shipped fixes and urged users to upgrade.

Key points

• Plex2Shell combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 to run arbitrary code on exposed Plex Media Servers without valid credentials.
• A researcher observed exploitation on an internet-facing honeypot on October 17, one day after technical details and proof-of-concept code were released.
• The attackers used the public exploit, possibly with modifications, according to the researcher.
• The honeypot observed an XMRig-based cryptocurrency miner and later a program identified as proxy software called myawesomeproxy.
• Plex said it had shipped fixes on September 1 and advised server owners to install the newest release without delay.
• The researcher cautioned that the published indicators of compromise reflect only activity observed on the honeypot.

MITRE ATT&CK

CVE

Malware

Vendors

Products

Related Articles

• Attackers Exploit AhsayCBS Flaws to Install XMRig Miners Disguised as Microsoft EdgeXMRig · T1190 · T1496
• Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and CryptominersXMRig · T1190 · T1496
• Aqua Details Fileless Cryptomining Campaign Targeting Containerized AppsXMRig · T1190 · T1496
• Talos Details How Adversaries Use AI to Build Malware, Scale Attacks and Steal CredentialsXMRig · T1190 · T1496
• Larva-26009 Uses Remote-Access Tools and SoftEther VPN in MS-SQL Server AttacksXMRig · T1190 · T1496