Anyone still running an unpatched Plex Media Server should treat the box as already reachable by strangers. A researcher who built a deliberately vulnerable decoy saw live exploitation begin on October 17, roughly 24 hours after the exploit chain went public.
The Plex2Shell chain bundles four separate bugs, catalogued as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together they hand over arbitrary code on an exposed installation, and the payload inherits whatever rights the Plex service itself holds. No account or credential is needed to start the attack.
Disclosure was orderly on the vendor side. Plex received the report on July 27, confirmed the findings and paid a bounty on August 4, then announced on September 1 that fixed builds were available and urged operators to upgrade. The write-up and working proof of concept followed on October 16.
What the honeypot logged in the following hours is the familiar pair. First an XMRig build, quietly mining on someone else’s hardware. Then, later the same day, a second binary the researcher recognised as proxy software, one that openly warns users their traffic may be resold.
The proxy is the part worth sitting with. Plex servers often live on residential connections, and a residential exit node is exactly what a criminal wants when reaching a corporate VPN or mailbox without tripping geographic alarms.
Published indicators cover only what landed on that one decoy, so absence of a match proves nothing about your own host. Check the Plex version first. If it predates the September release, assume the machine has been probed and look for outbound mining traffic and installed binaries you did not choose.
Source: SecurityWeek
