Plex2Shell exploits deploy miners and proxy malware
Plex2Shell vulnerabilities in Plex Media Server are being actively exploited to install cryptocurrency miners and proxy malware, according to an exploitation report cited after the flaws entered the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. The catalog identifies security flaws for which there is evidence of real-world exploitation, making these entries an immediate operational concern rather than a theoretical risk.
The four Plex Media Server vulnerabilities can be combined into an attack chain that gives a remote attacker unauthenticated remote code execution, according to the security researcher who discovered and reported them. In practical terms, the attacker would not need to sign in before making the server run chosen code. Plex addressed the issues in Plex Media Server 1.43.3.10861, released on August 3, 2026.
Two of the flaws are server-side request forgery (SSRF) vulnerabilities, which can make a server send requests selected by an attacker. CVE-2026-96652 and CVE-2026-96655 both carry Common Vulnerability Scoring System (CVSS) scores of 5.3. CVSS is a standard scale for describing the technical severity of a vulnerability.
CVE-2026-96654, with a CVSS score of 6.9, involves improper handling of encoded Uniform Resource Identifier (URI) schemes in a web page. A URI scheme is the opening part of an address that tells software how a resource should be handled. CVE-2026-96656 has a CVSS score of 8.6 and allows external control over a file name or path. Although the four individual scores differ, the reported risk comes from chaining the flaws together to reach remote code execution.
Security researcher boredhackerblog reported that attackers are weaponizing the Plex2Shell chain to deploy two kinds of unwanted software. Cryptocurrency miners consume a compromised machine's computing resources to perform cryptocurrency-related calculations. Proxy malware turns the affected system into an intermediary that can carry other network traffic. This exploitation means administrators should not treat installation of the fixed Plex release as a routine maintenance task.
CISA also flagged CVE-2026-110936 in Siemens Software Center as actively exploited. The vulnerability has a CVSS score of 8.4 and involves DLL sideloading, a technique in which software is made to load an unintended Dynamic Link Library instead of the expected component. The flaw has been abused in attacks identified as ClickFix using a platform called Romulus.
The other actively exploited issue is CVE-2026-106931, a command injection vulnerability in EG Secure Solutions SiteGuard Server Edition. Command injection allows attacker-supplied instructions to be passed to the operating system. The flaw has a CVSS score of 8.5, and the Japanese company confirmed that exploitation has occurred. No further information about that exploitation activity is currently available.
CISA is urging Federal Civilian Executive Branch (FCEB) agencies to apply fixes for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by October 23, 2026. The deadline for CVE-2026-96652, CVE-2026-96655 and CVE-2026-110936 is November 3, 2026. These deadlines directly apply to the federal agencies covered by the instruction, but the confirmed exploitation is also relevant to other organisations operating the affected products.
Website owners, hosting teams and business IT administrators should inventory systems for Plex Media Server, Siemens Software Center and SiteGuard Server Edition, then confirm that available vendor fixes have been applied. Because attackers are already deploying malware through Plex2Shell, updating closes the reported vulnerabilities but does not by itself establish whether an installation was compromised before it was patched. Organisations with affected or potentially exposed systems should therefore combine patching with a review for unexpected software and network activity.
For organisations that need assistance managing this kind of technical exposure, AEU-I provides security-first IT, infrastructure and consulting. The immediate priority remains identifying affected installations, applying the stated fixes within the relevant deadlines and checking previously vulnerable Plex systems for the reported cryptocurrency miners or proxy malware.