Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners

Hackers are now using a public exploit chain called Plex2Shell to break into unpatched Plex Media Server systems and install cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit code went public on October 16, 2026.

Plex2Shell links four flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, they let a remote user run code on a server without a password.

The code runs with the same rights as the Plex service. Security researcher Zach Main found the bugs and reported them to Plex on July 27. Plex confirmed the report and paid a bounty on August 4.

Hackers Exploit Plex2Shell Flaws

Plex Media Server often listens on port 32400, and many people leave it open to the internet so they can stream from anywhere. That makes it an easy target for anyone scanning for it.

The first flaw is a server-side request forgery bug in the /player/timeline endpoint. The server only checks that a token exists, not that it is valid, so even a fake token works. An attacker can then slip a full web address into the protocol field and trick Plex into sending a request to itself.

That request appears to come from the machine itself, which Plex trusts more. It opens a plugin interface that normally needs no token for local traffic. A broken check in the plugin code lets the attacker call other plugin functions.

The attacker then uses a TVDB plugin function and a web address that starts with 127.0.0.1 but points to a server the attacker controls. Plex sees the local prefix and adds the owner’s admin token to the request. The token goes straight to the attacker.

With the admin token, the attacker changes a transcoder setting so Plex writes a malicious file into its codec folder. The file is hidden inside a video. The next time Plex transcodes a video, it loads that file and runs it. The researcher’s write-up and proof-of-concept code are public on GitHub.

A researcher running a honeypot, a decoy server used to watch attacks, saw the first real exploitation on October 17. The attackers dropped an XMRig-based Monero miner and a Linux proxy tool called “myawesomeproxy.” The Hacker News reports that the miner pointed to a domain tied to the AISURU botnet. The attacks fetched payloads from 217.60.194[.]116.

Cybersecurity News also covered the first exploitation reports. It noted that the evidence did not show how many real servers were hit. The attack is not limited to home servers.

QNAP says some NAS users have been breached, and BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities list on October 20.

Update to Plex Media Server 1.43.3.10861 or newer, and check the version the server actually reports. Updating will not remove a payload that is already installed. QNAP advises treating an exposed server as compromised, checking for signs of infection, doing a clean reinstall, and resetting credentials.

Stop forwarding port 32400 if you do not need remote access. If you do need it, use a VPN. Also check the Plex process for strange child processes, unknown downloads, and high CPU use. Miners often show up first as a slow, hot server. For another example of how exposed services get turned into miners, see this Redis cryptojacking campaign.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners appeared first on Cyber Security News.