Plex2Shell exploitation started October 17, day after details published

Exploitation of the Plex2Shell vulnerability chain started on October 17, 2026, one day after a researcher published the technical details. The chain combines four CVEs in Plex Media Server to reach unauthenticated remote code execution, and the patch that closes it has been available since August 3.

The researcher who goes by boredhackerblog named the chain and documented the in-the-wild activity. The underlying flaws were disclosed to Plex on July 27, 2026 by security researcher Zach Main, together with CVE-2026-96651 (CVSS 7.1), and fixed in Plex Media Server 1.43.3.10861.

How the chain works

Four vulnerabilities run in sequence, each handing the next the access it needs:

• CVE-2026-96652 (CVSS 5.3) is an unauthenticated SSRF in the /player/timeline endpoint. The protocol parameter is dropped into a programmatically built player URL with no validation, so an attacker can force the Plex server to POST to a destination they control.
• CVE-2026-96654 (CVSS 6.9) is improper neutralization of URL values in the searchOne endpoint. It lets an attacker call other plugins’ functions with their own parameters and read back the owner’s admin token.
• CVE-2026-96655 (CVSS 5.3) is a second SSRF reachable with that owner token, via the /video/:/transcode/universal path parameter. An authenticated caller can make the server fetch any internal or external address, including an attacker-hosted “carrier video” that carries an ELF payload.
• CVE-2026-96656 (CVSS 8.6) is external control of a file path. It writes the ELF shared object into the Codecs directory at an attacker-chosen path and executes it.

No single score is alarming on its own. Strung together in this order they take an attacker from zero credentials to code execution on the host.

What gets dropped

The exploitation uses a shell script that pulls a miner payload named x12345 from 217.60.194[.]116 with wget or curl. Two artifacts land on compromised hosts. myawesomeproxy is described by VirusTotal as a stealthy Linux backdoor and reverse proxy; running it prints the line “Running this software on any of your devices makes you agree to the potential external use of your internet traffic.” Alongside it runs mylovelyminer, an XMRig process pointing at ota.proxystream[.]st. Bitsight flagged a sibling subdomain, global.relay.proxystream[.]st, in August 2026 in connection with the AISURU DDoS and proxyware botnet.

Observed source IPs for the attacks: 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222.

The two-payload pattern is the point. The miner monetizes CPU immediately. The proxyware backdoor sticks around, resells the host’s bandwidth, and keeps a channel open after anyone notices the fans spinning up.

What to do

Plex runs on a lot of home NAS boxes and self-hosted servers that face the internet, often on consumer connections where resold residential bandwidth has value to a proxyware operator. The patch has been out since August 3 and exploitation did not begin until the writeup appeared in mid-October, so the window to update ahead of attackers was real and is now closed.

Update to 1.43.3.10861 or later. On any instance that was exposed before patching, check the Codecs directory for ELF shared objects you did not put there, and look for processes named x12345, myawesomeproxy, or mylovelyminer. Block and review outbound connections to the listed source IPs and to proxystream[.]st.

Multiple Plex users on Reddit report finding the same mylovelyminer payload on their instances. Whether those compromises came through Plex2Shell has not been established. Plex also urged users to update more than a month ago after an earlier release fixed several unspecified security flaws, and it is not clear whether these CVEs were part of that alert.