Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware

What happened?

Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026. The activity follows the release of Plex2Shell, a public exploit that chains four vulnerabilities to run code without logging in. Later observations also revealed proxy software running alongside the miner. The findings from Boredhackerblog show active exploitation of an exposed test server, rather than scanning alone.

Key details

• The Plex2Shell exploit chains four vulnerabilities to achieve unauthenticated remote code execution.
• A researcher observed successful attacks against a honeypot on October 17, 2026, confirming active exploitation.
• Proxy software was found running alongside the miner, suggesting additional abuse of compromised servers.
• The exploit chain begins with server-side request forgery and ends by abusing an unsigned codec load.
• Plex released security updates on September 1, urging users to install Plex Media Server 1.43.3 and Plex Desktop 1.115.0.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.