Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners and Linux Backdoor

Threat actors are actively exploiting a chained set of four vulnerabilities in Plex Media Server — dubbed Plex2Shell — to install cryptocurrency miners and a stealthy Linux reverse proxy backdoor on compromised systems as of October 17, 2026.

The attacks began just one day after a public proof-of-concept (PoC) was released, underscoring a troubling pattern in modern cybersecurity: the window between vulnerability disclosure and real-world exploitation is shrinking to near zero. With millions of Plex users worldwide, the stakes for unpatched systems are significant — and growing by the hour. This incident is a stark reminder that delayed patching is no longer a manageable risk; it is an active liability.

---

What the Plex2Shell Vulnerability Chain Does

The Plex2Shell exploit chain links four distinct vulnerabilities that together enable unauthenticated remote code execution (RCE) on susceptible Plex Media Server instances. Security researcher Zach Main disclosed all four flaws — along with a fifth related vulnerability — to Plex on July 27, 2026.

Understanding how these vulnerabilities interlock is critical. No single flaw in the chain is sufficient on its own to achieve full system compromise — but together, they create a direct, credential-free path to complete code execution on a target machine. Attackers with even moderate technical skill can weaponize this sequence, particularly now that public PoC code is available.

The Four Vulnerabilities Explained

• CVE-2026-96652 (CVSS 5.3): A server-side request forgery (SSRF) flaw in the /player/timeline endpoint that allows attackers to force the Plex server to POST requests to an attacker-chosen destination.
• CVE-2026-96654 (CVSS 6.9): Improper URL neutralization in the searchOne endpoint that allows an attacker to call plugin functions and extract the owner's admin token.
• CVE-2026-96655 (CVSS 5.3): An authenticated SSRF vulnerability allowing requests to arbitrary internal or external addresses via the /video/:/transcode/universal path — including attacker-hosted malicious payloads.
• CVE-2026-96656 (CVSS 8.6): An external file path control flaw that writes a malicious ELF shared object to the Codecs directory and executes it.

Chained in sequence, these vulnerabilities allow a remote attacker with no credentials to achieve full code execution on a target system. To understand the broader landscape of threats these techniques fit within, it's worth reviewing the different types of malware used in modern cyberattacks — from trojans and rootkits to the kind of cryptomining payloads deployed here.

Plex addressed all identified flaws in Plex Media Server version 1.43.3.10861, released on August 3, 2026 — more than two months before exploitation began in the wild.

---

Crypto Miners and a Proxy Backdoor Deployed in Active Attacks

Active exploitation was recorded beginning October 17, 2026 — one day after technical details of the Plex2Shell chain were published publicly on October 16. Researchers including a security analyst known online as boredhackerblog documented the attack methodology in detail.

How the Attack Is Delivered

The attacks use a shell script to retrieve and deploy a cryptocurrency miner payload identified as "x12345" from a remote server at IP address 217.60.194[.]116, using standard tools like wget or curl. Attack traffic has been traced to four IP addresses: 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222, and a repeated instance of 176.65.139[.]228.

The use of standard system utilities like wget and curl to fetch malicious payloads is a deliberate evasion tactic — these tools generate traffic that blends naturally with legitimate server behaviour, making early detection considerably harder without dedicated monitoring.

The Backdoor: myawesomeproxy

Alongside the miner, attackers are deploying an artifact named "myawesomeproxy" — identified on VirusTotal as a stealthy Linux backdoor and reverse proxy. When executed, the program displays a warning message stating:

"Running this software on any of your devices makes you agree to the potential external use of your internet traffic."

This message is notable for its brazenness. The operators appear unconcerned about visibility once execution has occurred — suggesting confidence in their ability to maintain persistence and evade removal.

The XMRig Connection and Broader Botnet Infrastructure

Concurrently, an XMRig miner process — labeled "mylovelyminer" — has been deployed with its mining pool pointed at ota.proxystream[.]st. This domain is significant: a related subdomain, global.relay.proxystream[.]st, was flagged by cybersecurity firm Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet.

This connection suggests the threat actors behind these attacks may have a broader infrastructure dedicated to traffic monetization and distributed denial-of-service operations — meaning compromised Plex servers may be used not only for mining revenue, but as nodes in a larger attack network targeting third parties.

Reddit posts from affected users confirm that multiple Plex instances have been compromised with the "mylovelyminer" payload. However, it remains unconfirmed at this stage whether all reported infections stem directly from the Plex2Shell exploit chain.

Given the stealthy nature of these payloads, users who suspect compromise should consult resources on the best free malware removal tools available to help identify and eliminate persistent threats from affected systems.

---

What Plex Users Need to Know Right Now

The Patching Gap That Made This Possible

The exploitation timeline reveals a critical gap in user response. Plex released the patched version on August 3, 2026 — yet a significant number of deployments remained unpatched more than two months later when attackers began striking. The situation echoes the 2021 Log4Shell crisis, when unpatched systems were compromised within hours of public PoC release despite patches being available.

Patch fatigue is a known and documented problem in both enterprise and home server environments — but incidents like this illustrate the concrete consequences of treating security updates as low-priority maintenance tasks. For internet-facing services in particular, the question is not whether exploitation will occur, but how quickly.

Plex had previously urged users to update their installations following a security advisory about multiple unspecified vulnerabilities. It remains unclear whether that earlier alert specifically referenced the Plex2Shell flaws. The Hacker News has contacted Plex for comment and will update reporting when a response is received.

For users and administrators running Plex Media Server, the guidance is unambiguous: update immediately to version 1.43.3.10861 or later to close all known attack vectors in the Plex2Shell chain. You can review Plex's official security advisories and update guidance directly on the Plex support and security page.

Three Lessons for Anyone Running Internet-Facing Software

The incident reinforces three actionable lessons for anyone managing internet-facing media or home server software.

1. Treat patch cycles as urgent, not optional — particularly when PoC exploit code becomes publicly available. The gap between disclosure and exploitation is now measured in hours, not weeks.
2. Monitor outbound network traffic for unexpected connections to unknown mining pools or proxy servers. Anomalous outbound traffic is frequently the earliest detectable indicator of compromise.
3. Review exposed services for known indicators of compromise — including unfamiliar processes like "mylovelyminer" or "myawesomeproxy" — to identify infections before they escalate into broader network intrusions.

It is also worth noting that the monetisation model behind these attacks — combining cryptomining with proxyware and potential DDoS infrastructure — reflects an increasingly common approach among financially motivated threat actors. Understanding how ransomware and extortion-based attacks operate provides useful context for recognising where these campaigns can escalate if left unchecked.

The core message is simple: if you run Plex Media Server and have not updated since August 2026, your system should be considered at risk until patched and verified.