Full Report
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Analysis Summary
# Vulnerability: Plex2Shell, a Four-Bug Chain in Plex Media Server Leading to Unauthenticated RCE
*Note: The source article is truncated, so some details (vulnerable version ranges, CWE mappings, and the CVE-2026-96651 description) are not confirmed. Items marked "inferred" are my analysis, not article claims.*
## CVE Details
- **CVE IDs:**
- CVE-2026-96652 (CVSS 5.3, Medium): SSRF via `/player/timeline`
- CVE-2026-96654 (CVSS 6.9, Medium): URL neutralization flaw in `searchOne` endpoint, leading to admin token disclosure
- CVE-2026-96655 (CVSS 5.3, Medium): Authenticated SSRF via `/video/:/transcode/universal`
- CVE-2026-96656 (CVSS 8.6, High): External control of file name or path, enabling ELF shared object placement and execution
- CVE-2026-96651 (CVSS 7.1, High): Disclosed and patched alongside the chain; the article does not describe it
- **CWE (inferred, not stated in article):**
- CVE-2026-96652 and CVE-2026-96655: CWE-918 (Server-Side Request Forgery)
- CVE-2026-96656: CWE-73 (External Control of File Name or Path)
- CVE-2026-96654: likely CWE-20 (Improper Input Validation) or a related URL-handling weakness
## Affected Systems
- **Products:** Plex Media Server
- **Versions:** Versions prior to 1.43.3.10861 are presumed vulnerable (inferred from the patch release). The article does not list exact affected ranges.
- **Configurations:** The chain's impact depends on exposure. The article does not specify configuration prerequisites beyond the requirement for the attacker to reach the server over the network.
## Vulnerability Description
Plex2Shell chains four bugs to achieve unauthenticated remote code execution:
1. **SSRF in `/player/timeline` (CVE-2026-96652):** The `protocol` parameter is inserted into a programmatically built player URL without validation. An attacker can force the server to send POST requests to an arbitrary destination.
2. **Token disclosure via `searchOne` (CVE-2026-96654):** Improper neutralization of URL values lets an attacker call functions in other plugins with attacker-supplied parameters, exposing the owner's admin token.
3. **Authenticated SSRF in transcode path (CVE-2026-96655):** Using the owner token, an attacker can make the server fetch internal or external resources, such as a malicious video file containing an ELF payload, via `/video/:/transcode/universal`.
4. **Arbitrary file write and execution (CVE-2026-96656):** The attacker-controlled ELF shared object is written to an attacker-chosen path within the Codecs directory and executed.
## Exploitation
- **Status:** Exploited in the wild, with PoC available. A public PoC was released October 16, 2026, and exploitation was observed the following day.
- **Complexity:** Medium (inferred). The chain requires four steps, and the later stages depend on the token obtained earlier.
- **Attack Vector:** Network
**Observed activity:**
- Deployment of an XMRig cryptominer ("mylovelyminer") pointed at a mining pool
- Deployment of a Linux reverse proxy backdoor ("myawesomeproxy")
- Payload delivered from 217.60.194[.]116
## Impact
- **Confidentiality:** High (inferred). Admin token theft and server access expose library data and credentials.
- **Integrity:** High (inferred). Arbitrary code execution allows full system modification.
- **Availability:** High (inferred). Attackers can run miners and persist on the host, degrading resources and enabling further abuse.
## Remediation
### Patches
- Update to **Plex Media Server 1.43.3.10861 or later**, released August 3, 2026. The vendor released this patch roughly 2.5 months before public exploitation began, so unpatched servers remain exposed.
### Workarounds
- Restrict Plex server access to trusted networks and disable public or remote access if it is not required.
- Block outbound connections from the Plex server to unknown external hosts, which limits payload retrieval and C2 communication.
- Monitor and restrict write access to the Plex Codecs directory.
- If patching is not immediately possible, place the server behind a VPN or access gateway.
## Detection
**Indicators of compromise:**
- **Attacker IPs:** 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222
- **Payload server:** 217.60.194[.]116
- **Malicious files:** "myawesomeproxy" (SHA-256: e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9)
- **Malicious processes:** "mylovelyminer" (XMRig miner), "myawesomeproxy" (reverse proxy)
- **Suspicious domains:** ota.proxystream[.]st, global.relay.proxystream[.]st (the latter was linked to the AISURU botnet in August 2026)
- **Unexpected ELF files** in the Plex Codecs directory
**Detection methods:**
- Review Plex web logs for requests to `/player/timeline` with unusual `protocol` values, requests to `/searchOne`, and requests to `/video/:/transcode/universal` that reference external or internal addresses.
- Hunt for new or unexpected ELF binaries in the Codecs directory and unfamiliar running processes.
- Check outbound network logs for connections to the listed IPs and domains.
- Review scheduled tasks, cron jobs, and startup scripts for persistence.
- Audit the owner account for unexpected token use.
**Response if compromised:** Treat the host as fully compromised. Rotate the Plex owner token and all credentials stored on or accessible from the server, then rebuild the system from a clean image.
## References
- The Hacker News article: hxxps[://]thehackernews[.]com/2026/10/hackers-exploit-plex2shell-flaws-to[.]html
- Researcher disclosure write-up (boredhackerblog): hxxps[://]www[.]boredhackerblog[.]info/2026/10/plex-vulnerabilities-being-exploited-in[.]html
- Plex2Shell proof of concept: hxxps[://]github[.]com/code-zm/plex2shell/
- Original disclosure by Zach Main: hxxps[://]zmain[.]info/blog/plex2shell
- Plex patch release thread: hxxps[://]forums[.]plex[.]tv/t/plex-media-server/30447/712
- CVE records: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-96651
- Reddit reports of compromised servers: hxxps[://]www[.]reddit[.]com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/