Plex2Shell exploit chain enables unauthenticated remote code execution on media servers

Threat actors have started exploiting a critical chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software. This active exploitation began immediately after technical details and proof-of-concept code for the exploit chain, known as Plex2Shell, were made public on October 16, 2026.

What happened

Security researcher Zach Main disclosed five vulnerabilities to Plex on July 27, 2026. The company addressed four of these, collectively termed Plex2Shell, in Plex Media Server version 1.43.3.10861, which was released on August 3, 2026. A fifth vulnerability, CVE-2026-96651, was also part of the disclosure but is not part of the primary exploitation chain described here.

Despite the patch being available for over two months, active exploitation only surged after a researcher using the alias boredhackerblog published a technical breakdown of how to chain the flaws on October 16, 2026. Within 24 hours, in-the-wild attacks were recorded. These attacks target susceptible instances that have not been updated to the patched version.

The exploitation has resulted in the deployment of malicious payloads from remote servers, specifically IP address 217.60.194[.]116. Attack traffic has been observed originating from several IP addresses, including 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222. The goal appears to be resource hijacking and network infiltration rather than simple data theft or ransomware.

How it works

The Plex2Shell exploit chain combines four distinct vulnerabilities to achieve unauthenticated remote code execution. The process begins with CVE-2026-96652, an unauthenticated server-side request forgery (SSRF) flaw. This vulnerability exists in the "/player/timeline" endpoint, where the "protocol" parameter is inserted into a URL without validation. This allows an attacker to force the Plex server to send POST requests to any destination they choose.

Next, the attacker leverages CVE-2026-96654, which involves improper neutralization of URL values in the "searchOne" endpoint. This flaw allows the attacker to call functions from other plugins and supply custom parameters. By doing so, they can obtain the owner's admin token, effectively escalating their privileges from unauthenticated to authenticated administrator status.

With the admin token secured, the attacker uses CVE-2026-96655, another SSRF vulnerability. This flaw allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path. The attacker uses this to fetch a malicious ELF payload hosted on an external server, disguising it as a carrier video. Finally, CVE-2026-96656, an external control of file name or path vulnerability, allows the attacker to write this ELF shared object to a specific path in the Codecs directory and execute it. This final step grants the attacker full remote code execution on the server.

Key details

• The exploit chain, named Plex2Shell, consists of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
• Patches were released in Plex Media Server 1.43.3.10861 on August 3, 2026, following disclosure on July 27, 2026.
• Active exploitation began on October 17, 2026, one day after proof-of-concept details were published.
• Attackers deploy a Linux backdoor named "myawesomeproxy" and an XMRig miner process called "mylovelyminer".
• The mining server connects to "ota.proxystream[.]st", a domain linked to the AISURU DDoS botnet.
• The backdoor displays a message stating that running it agrees to the external use of internet traffic.

Why it matters

For engineers and system administrators managing self-hosted infrastructure, this incident highlights the severe risk of delayed patching. While the vulnerabilities were patched in August, the availability of a clear exploit chain in October triggered immediate automated attacks. This demonstrates that security through obscurity is ineffective once technical details are public. Self-hosted services, often perceived as safer due to isolation, are prime targets when they expose complex web interfaces to the internet.

The deployment of both a crypto miner and a reverse proxy backdoor indicates a dual threat model. The miner consumes computational resources, potentially degrading service performance and increasing electricity costs. More critically, the "myawesomeproxy" backdoor turns the compromised server into a node for routing malicious traffic. This can implicate the server owner in further attacks, such as DDoS campaigns, and compromise network integrity beyond the single host.

The connection to the AISURU botnet suggests organized criminal involvement rather than opportunistic script kiddies. The use of established infrastructure like "global.relay.proxystream[.]st" indicates a mature operation. For technical founders and IT leads, this underscores the need for rigorous update policies and network monitoring for all exposed services, not just customer-facing applications.

What you can do

• Immediately update Plex Media Server to version 1.43.3.10861 or later if you have not already done so.
• Check your server logs for suspicious POST requests to "/player/timeline" or unusual activity on "/video/:/transcode/universal".
• Monitor for unknown processes named "mylovelyminer" or "myawesomeproxy" running on your Linux hosts.
• Block outbound connections to known malicious IPs such as 217.60.194[.]116 and domains like "ota.proxystream[.]st".
• Restrict access to your Plex Media Server interface using firewalls or reverse proxies to limit exposure to untrusted networks.
• Audit other self-hosted services for similar unpatched vulnerabilities and ensure automatic updates are enabled where possible.