Attackers reportedly used four Plex Media Server vulnerabilities to install XMRig miners and proxy software on exposed, unpatched systems just hours after exploit code was published.
Security researchers say attackers moved with unusual speed to exploit Plex2Shell, a chain of four vulnerabilities in Plex Media Server, after technical details and proof-of-concept code were made public on 16 October 2026. According to SecurityWeek and The Hacker News, exploitation attempts were then observed on 17 October, with compromised systems used to deploy a cryptocurrency miner and proxy software. The episode underscores how quickly public research can be turned into operational attacks against internet-exposed servers.
The vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can reportedly be chained to achieve unauthenticated remote code execution on affected Plex installations. In practical terms, that means an attacker may not need valid credentials to run commands on a vulnerable server. Plex had already released fixes on 1 September 2026 and urged administrators to update, according to the published reports, which means the immediate danger is concentrated on systems that were left unpatched or were never brought back into compliance after the fix became available.
The first payload seen on the honeypot was XMRig, a widely used mining tool that is often abused to convert compromised machines into unauthorised crypto-mining infrastructure. The second was identified as proxy software called myawesomeproxy, which appeared to carry a notice suggesting users accepted that their traffic might be used in that way. That combination is significant because it suggests attackers may be interested not only in extracting computing power but also in abusing residential internet connections as a route for further network activity.
That residential angle matters. A household or small-office Plex server can present an ordinary consumer IP address, which may look less suspicious than traffic from a data centre. As Security Affairs and MadeInCyber.it reported, such infrastructure can be attractive for routing malicious requests through a victim’s connection, even if there is no proof in this case that the observed actors actually used the proxy to penetrate corporate networks or steal credentials. The available evidence shows the software was deployed; it does not prove every feared downstream abuse occurred.
The observations came from a researcher running a vulnerable honeypot, which is useful for seeing attacker behaviour but does not reveal the full scale of a campaign. The published indicators therefore describe what was seen in that environment, not every variant that may exist in the wild. Even so, the conclusion is clear: once working exploit code became public, exploitation followed quickly, and the payloads indicate a mix of resource theft and potential network-abuse tooling. For administrators, the priority is to verify that Plex Media Server is updated, review any internet-facing instances that may have been overlooked, and investigate for signs of compromise rather than assuming that patching alone is enough.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
