- Threat actors are exploiting a chain of four vulnerabilities in Plex Media Server, dubbed Plex2Shell, to deploy cryptocurrency miners and reverse proxy software.
- A public proof-of-concept (PoC) was released on October 16, 2026, with in-the-wild attacks observed the following day from IPs including 91.92.40[.]202 and 176.65.139[.]228.
- The attacks deploy an XMRig miner (“mylovelyminer”) and a Linux backdoor (“myawesomeproxy”), both linked to the AISURU botnet infrastructure.
- Plex patched these flaws on August 3, 2026, in version 1.43.3.10861; users are strongly advised to update their instances immediately.
On October 19, 2026, researchers reported that threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, just one day after a public proof-of-concept (PoC) emerged. The exploit chain, named Plex2Shell and disclosed by security researcher Zach Main, allows unauthenticated remote code execution on susceptible instances.
The vulnerabilities include CVE-2026-96652 (an SSRF via the player endpoint), CVE-2026-96654 (token theft), CVE-2026-96655 (authenticated SSRF), and CVE-2026-96656 (arbitrary file execution). Plex addressed all four flaws in a patch released on August 3, 2026. However, according to a researcher using the alias boredhackerblog, exploitation attempts were recorded starting October 17, 2026, targeting unpatched servers from IPs such as 91.92.40[.]202 and 176.65.139[.]228.
The attacks deliver a payload named “myawesomeproxy,” described as a stealthy Linux backdoor and reverse proxy. The program displays a message stating: “Running this software on any of your devices makes you agree to the potential external use of your internet traffic.” Concurrently, an XMRig miner process called “mylovelyminer” is deployed, pointing its mining server to ota.proxystream[.]st. That domain overlaps with the AISURU DDoS and proxyware botnet, previously flagged by Bitsight in August 2026.
Posts on Reddit indicate multiple Plex users have reported compromised instances carrying the same “mylovelyminer” payload. Users are urged to update their installations to the latest version for protection.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
