Hackers are exploiting Plex2Shell to plant crypto miners on media servers as nearly 49,000 stay unpatched

Attackers are using a public exploit chain called Plex2Shell to plant crypto miners and residential proxy software on outdated Plex servers, and nearly 49,000 internet-exposed hosts remain vulnerable. The activity was first spotted on October 17, a day after proof-of-concept code went public.

The attack, known as Plex2Shell, affects Plex Media Server installations that have not been updated to version 1.43.3.10861 or later. The exploit could allow attackers to abuse a victim’s computing resources to mine cryptocurrency while potentially using their internet connection to route third-party traffic.

Plex servers targeted through four security vulnerabilities

The Plex2Shell exploit chain was publicly disclosed by a security researcher known as ZM, who published a technical write-up and proof-of-concept code on October 16, 2026.

According to the report by SecurityWeek, the exploit combines four vulnerabilities identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, the flaws enable unauthenticated remote code execution on vulnerable Plex Media Server installations accessible over the internet.

The attack reportedly involves obtaining an administrator’s authentication token before placing a malicious file on the compromised system. The file can subsequently execute when the server performs a media transcoding operation, allowing the attacker to maintain access to the machine’s resources.

A researcher operating the cybersecurity blog boredhackerblog reported observing the exploit being used against a honeypot running an outdated version of Plex Media Server on the morning of October 17.

The first malicious payload identified was XMRig, a widely used cryptocurrency mining program. A residential proxy tool called myawesomeproxy was deployed later the same day.

Cryptocurrency miners use a compromised computer’s processing power to generate digital assets. Depending on the mining configuration, this can increase electricity consumption, degrade system performance and place additional strain on hardware.

Residential proxy software creates a different security risk by allowing external users to route internet traffic through another person’s connection. This can make activity originating from the proxy appear to come from the victim’s network, potentially exposing the network owner to unwanted scrutiny.

The proxy tool reportedly displayed a warning acknowledging that running the software meant accepting “the potential external use of your internet traffic”.

However, the available evidence does not establish how many production servers have been compromised or identify the individuals responsible for the attacks.

Plex servers remain exposed despite September security fix

Plex had already addressed the vulnerabilities before ZM publicly disclosed the exploit chain.

The company’s security advisory, published on September 1, urged administrators running Plex Media Server version 1.43.2 and earlier to update their installations.

The subsequent disclosure of working exploit code appears to have increased the urgency of that warning, as attackers could use the publicly available technical details to target systems that remained unpatched.

According to Gizmodo, cybersecurity monitoring data from Shadowserver showed that nearly 49,000 internet-connected hosts were still identified as vulnerable on October 17. Approximately 25,100 were located in North America, while another 17,600 were in Europe.

These figures indicate the potential scale of exposure, but they do not establish that every vulnerable host was successfully compromised or that all identified systems were necessarily running the same configuration.

The incident also raised questions about how quickly users were informed about the risks and whether stronger measures were needed to encourage updates.

Plex’s optional automatic update setting reportedly defaults to “Ask me” and applies only to Windows and macOS installations. As a result, administrators running Linux, Docker or NAS deployments may need to update their systems manually through package managers, container images or downloaded installation files.

This distinction is important because installing an update on one component does not necessarily guarantee that the server currently running is protected. Administrators must verify the actual software version after completing the update.

The company had not issued a new public statement specifically addressing the observed attacks as of the reporting period described by Gizmodo.

The disclosure also attracted criticism on social media over the $500 bounty Plex reportedly paid ZM for the vulnerabilities. The discussion raised questions about the reward offered for identifying a security issue with potentially significant consequences for internet-facing installations.

Nevertheless, the bounty debate is separate from the immediate security concern: vulnerable systems remain at risk until they are updated and any existing compromise is addressed.

How to protect Plex servers from crypto mining malware

Administrators should first confirm that their Plex Media Server installation is running version 1.43.3.10861 or later.

Updating is particularly important for Plex servers that can be accessed from outside a home or office network. Systems that are not exposed to the internet face less direct exposure to this reported attack, but installing the security fix remains advisable because the exploit code is publicly available.

Administrators should also investigate signs of suspicious activity rather than assuming that an update alone will remove malware that may already have been installed.

On Linux systems, the researcher reportedly recommended examining the Plex process tree using the ps axjf command to identify unexpected child processes. Unfamiliar downloads, mining programs and proxy software may also warrant investigation.

The server’s Codecs folder deserves particular attention because the malicious payload was reportedly placed there to execute during media transcoding.

Kraken Chief Security Officer Nick Percoco highlighted the persistence risk in a post on X, explaining that the malicious file could execute again whenever the server transcoded media.

As Percoco put it, “so killing the miner doesn’t fix it”.

The warning means administrators should not rely solely on terminating a visible mining process. If a server is confirmed to be compromised, a more thorough response may be necessary, including isolating the system, updating the software, investigating suspicious files and rebuilding the installation from a clean source where appropriate.

Administrators should also consider whether account credentials or authentication tokens may have been exposed. Reviewing access, rotating affected credentials and removing unnecessary router port-forwarding rules can help reduce further risks.