Plex2Shell attacks deploy miners and Linux backdoor
Plex2Shell attacks have begun targeting vulnerable Plex Media Server installations, with observed compromises deploying cryptocurrency mining software and a Linux backdoor that can relay other parties' internet traffic. The activity was recorded one day after proof-of-concept (PoC) code, a public demonstration of how a flaw can be exploited, became available. A security researcher using the alias boredhackerblog attributes the attacks to a chain of four vulnerabilities that can produce unauthenticated remote code execution, meaning an attacker can run code on a server without first signing in.
The chain begins with CVE-2026-96652, rated 5.3 under the Common Vulnerability Scoring System (CVSS), a standard scale for describing vulnerability severity. It is a server-side request forgery (SSRF) flaw, which lets an attacker make the affected server send a request to another destination. The problem is in the /player/timeline endpoint, where Plex inserts an unchecked protocol parameter into a player URL. An unauthenticated attacker can use this behavior to make the server send a POST request to a chosen destination.
The second stage, CVE-2026-96654, has a CVSS score of 6.9 and affects the searchOne endpoint. Plex does not properly neutralize URL values supplied through this endpoint, allowing an attacker to invoke functions belonging to other plugins, which are software extensions, and provide attacker-controlled parameters. According to the technical account, this step can expose the owner's admin token, a secret value that grants administrative access without requiring the password to be entered again.
CVE-2026-96655, rated 5.3, then allows someone holding the owner token to make requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. One example described by the researcher involves retrieving an attacker-hosted video carrying a malicious Executable and Linkable Format (ELF) payload, a type of program file used on Linux systems. The final flaw, CVE-2026-96656, is rated 8.6 and lets an attacker control where an ELF shared object, a Linux program component, is placed inside the Codecs directory before it is executed. Used in that order, the four issues provide a path from an unauthenticated request to code execution on the Plex server.
The vulnerabilities were disclosed to Plex on July 27, 2026, together with CVE-2026-96651, which has a CVSS score of 7.1. Plex Media Server 1.43.3.10861, released on August 3, 2026, patched the reported flaws. Technical information about the Plex2Shell chain became public on October 16, 2026, and in-the-wild exploitation attempts were recorded the following day. This timing makes the update particularly important for installations that remain on an older release.
The observed attacks downloaded a cryptocurrency miner from 217.60.194[.]116. Reported attack traffic came from 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222, with 176.65.139[.]228 appearing twice in the published list. The deployed XMRig miner, software that uses a compromised computer's processing power to generate cryptocurrency, ran under the name mylovelyminer and connected to the mining server ota.proxystream[.]st.
Attackers also installed an artifact called myawesomeproxy. VirusTotal describes it as a stealthy Linux backdoor and reverse proxy, software that can route network connections through the compromised machine. When run, it displays a message stating that using the software constitutes agreement to possible external use of the device's internet traffic. Bitsight had previously flagged another host under the same domain, global.relay.proxystream[.]st, in August 2026 in connection with the AISURU distributed denial-of-service (DDoS) and proxyware botnet. A DDoS attack overwhelms an online service with traffic, while proxyware makes a device's connection available for relaying other traffic.
Reddit posts indicate that several Plex users found the same mylovelyminer payload on their systems. However, it remains unconfirmed whether those particular infections resulted from Plex2Shell exploitation. Plex had also urged customers more than a month earlier to install the latest release after an update addressed several unspecified security issues, but it is unclear whether that notice covered these vulnerabilities. The Hacker News contacted Plex for comment, and a response was not reported in the account of the attacks.
Administrators should update Plex Media Server and investigate systems that remained unpatched after the technical details became public. The deployment of both a miner and a traffic-relaying backdoor means a compromise can consume the host's resources while also allowing its internet connection to be used externally. For organisations that need assistance maintaining internet-facing systems, AEU-I provides security-first IT, infrastructure and consulting. Any server showing the named payloads should be treated as potentially compromised rather than considered safe merely because it has since been updated.