Hackers exploit Plex2Shell flaws to deploy crypto miner

Plex Media Server users are being urged to update after researchers observed attackers exploiting a chain of vulnerabilities known as Plex2Shell to install a cryptocurrency miner and a Linux reverse proxy backdoor.

The activity was reported after a proof-of-concept for the chain became public. The Hacker News says the attacks combine four vulnerabilities to reach unauthenticated remote code execution on susceptible installations. The chain includes an unauthenticated server-side request forgery flaw in the `/player/timeline` endpoint, a weakness in `searchOne` that can expose an administrator token, an authenticated SSRF issue in the universal transcoder path and a path-handling flaw that can place an ELF shared object in Plex's Codecs directory.

The reported CVEs are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Their published CVSS scores range from 5.3 to 8.6, with the path-handling vulnerability carrying the highest score in the chain. A fifth issue, CVE-2026-96651, was disclosed alongside them.

What the attacks are doing

According to the report, exploitation has been used to deploy an XMRig process called “mylovelyminer”, with mining traffic directed to infrastructure linked to the proxystream.st domain. Attackers have also delivered “myawesomeproxy”, a Linux backdoor and reverse proxy that can allow the operator to use a compromised machine's internet connection.

The observed activity followed the public release of technical details on October 16. The vulnerabilities were disclosed to Plex on July 27 and were patched in Plex Media Server 1.43.3.10861, released on August 3, according to the report. That means the immediate defensive step is straightforward: check the installed server version and update any instance below the patched release.

The distinction between confirmed exploitation and online speculation matters here. The Hacker News reports multiple observations tied to the miner payload, while Reddit posts have described similar compromises without proving that every incident came through Plex2Shell. Plex users should therefore treat unverified reports as warning signs, not as a complete incident timeline.

What Plex users should do

Update Plex Media Server from the official Plex download channel, then review the host for unfamiliar processes, unexpected files in the Codecs directory and unusual outbound traffic. A server that has already run an unknown miner or proxy should be treated as potentially compromised rather than simply patched and forgotten.

Operators should also rotate relevant credentials after investigating a suspected compromise, review administrator access and check whether the server is exposed directly to the internet. Those steps do not replace incident-response advice from a qualified security professional, but they reduce the chance that an attacker retains access through a stolen token or an additional foothold.

Plex's official release channel remains the right place to confirm the current server build. The forum announcement linked below documents the vendor's release process, while the original security report provides the exploitation details and the list of affected CVEs.

Our opinion

This is the sort of home-server warning that deserves attention precisely because the software is often treated as harmless infrastructure. A media server can still hold administrator credentials, reach private networks and provide a useful internet connection for criminals. The reported chain also shows why “I only use it for streaming” is not a meaningful security boundary.

The practical takeaway is less dramatic than the payload names: patch to the fixed release, reduce unnecessary exposure and investigate signs of compromise instead of assuming an update erases an attacker who may already be inside. Plex users do not need to panic, but they do need to know which version they are running.

The Hacker News report says Plex was contacted for comment and that the story may be updated if the company responds.