Attackers have used the publicly released “Plex2Shell” exploit chain against an internet-facing Plex Media Server honeypot, installing an XMRig-based cryptocurrency miner and proxy software called “myawesomeproxy.”
The first exploitation was recorded on the morning of 17 October, according to the researcher operating the honeypot. That was one day after another researcher published technical details and proof-of-concept code on 16 October. The observation comes from a single decoy server and does not establish the wider scale of exploitation.
Plex2Shell combines four vulnerabilities in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The NVD descriptions identify Plex Media Server versions before 1.43.3.10861 as vulnerable.
Exploitation followed the public proof of concept
The flaws were reported to Plex on 27 July. Plex confirmed them and awarded a bug bounty on 4 August, according to the published account of the vulnerability chain and subsequent attacks.
On 1 September, Plex announced that fixes had shipped and advised server operators to install the newest release. The technical write-up and proof-of-concept exploit became public on 16 October.
Before 17 October, the honeypot had mainly received reconnaissance traffic and generic attacks. The researcher said the first Plex2Shell exploitation arrived the next morning and appeared to use the public exploit, potentially with modifications.
The attackers deployed a cryptocurrency miner based on XMRig. Later on 17 October, the honeypot received a second program, “myawesomeproxy.” The researcher characterized it as proxy software; its interface warns operators that running it may allow their internet connection to carry third-party traffic.
The suggestion that compromised Plex systems could become residential proxies for reaching corporate VPNs or email services is the researcher’s assessment, rather than an activity observed through the honeypot.
How the four vulnerabilities fit into the risk
The report describes Plex2Shell as a chain capable of running arbitrary code with the privileges of the Plex service. The available CVE data, however, assigns different access requirements to the individual flaws, and does not document how the complete chain moves between those requirements.
| Vulnerability | Technical effect | CVSS v3 |
|---|---|---|
| CVE-2026-96652 | Server-side request forgery through /player/timeline. Any X-Plex-Token value can be supplied, while a full URL in protocol causes Plex to send a POST request to a selected destination. |
4.3 |
| CVE-2026-96654 | Improper handling of URL values in searchOne, allowing calls to functions exposed by other plugins with attacker-controlled parameters. NVD rates this flaw as requiring no privileges. |
6.5 |
| CVE-2026-96655 | An authenticated user can make requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. |
4.3 |
| CVE-2026-96656 | An administrator can write files that may run when loaded. TranscoderH264Options is inserted directly into the x264 options for each transcode, while .so files run at startup without signature, execute-bit, or symbol validation. |
7.2 |
CVE-2026-96656 has the highest severity score of the four and is rated as requiring high privileges when considered by itself. CVE-2026-96654, by contrast, has a no-privileges-required vector. Without the chain’s full technical sequence, the access conditions of one component should not be treated as the prerequisites for the complete exploit.
Plex server operators should update and check for payloads
Administrators running Plex Media Server releases before 1.43.3.10861 should upgrade to the newest available version. Plex said fixes had already been distributed by 1 September, before the proof-of-concept publication and the activity recorded by the honeypot.
Operators of exposed servers should also inspect them for unexpected mining or proxy processes, particularly artifacts associated with XMRig or “myawesomeproxy.” The honeypot researcher published indicators of compromise for the activity observed there, but those indicators cover that specific dataset rather than every possible use of Plex2Shell.
