Hackers Exploit Vulnerability in Plex to Install Cryptocurrency Miners on Thousands of Servers

Cybercriminals have been exploiting a chain of four security vulnerabilities in Plex Media Server since October 17 to remotely take control of home servers without needing a password, install cryptocurrency miners, and turn the machines into intermediaries for anonymous traffic. The chain of vulnerabilities, dubbed Plex2Shell, combines four flaws: a server-side request forgery without authentication, unauthorized access to internal program functions, theft of the server owner's admin token, and arbitrary file writing in the codecs folder. Together, these allow code execution with the same permissions as the Plex service itself. Plex fixed the four vulnerabilities in early September with version 1.43.3 and then urged users to update. Three weeks later, it published the corresponding identifiers: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, one of which has a severity of 8.6 out of 10. A security researcher published a technical report on October 16 with the code capable of chaining the four vulnerabilities and executing them remotely without valid credentials. "These vulnerabilities are being actively and widely exploited. If your server is older than version 1.43.3.10861 and is accessible from the internet, assume that it may be compromised," Plex warned in a statement published on October 19 on its official support forum.

Cryptocurrency Miners and Hidden Proxies

A second researcher set up a honeypot server with a vulnerable version to track the attacks in real-time. He detected the first exploitation attempts on October 17, a day after the code became publicly available. The attackers first installed a cryptocurrency miner based on XMRig and, hours later, a program called myawesomeproxy, which turns the infected server into an internet traffic intermediary. This program allows third parties to route their own traffic through the victim's connection to hide its origin. "Plex is often hosted on residential IP addresses, and attackers specifically seek this type of proxy to access corporate networks and emails," wrote the researcher who detected the activity, as quoted by Ars Technica. The threat monitoring firm Shadowserver detected more than 48,000 Plex servers exposed directly to the internet with vulnerable versions, according to the German media Golem.de based on scans from that organization.

What Users Should Do

Plex recommended updating immediately to version 1.43.3.10861 or later from the program's general settings. It also urged users to check for any unknown processes stemming from the service or unrecognized files within the codecs folder. Another warning sign is outgoing connections to the domain proxystream.st, indicating that the machine has already been compromised by the proxy program. If any of these traces are detected, the company suggests reinstalling the server from scratch instead of reusing the previous data folder. It also advised logging out of all devices linked to the account and changing the password. For those who do not need remote access, Plex suggested disabling that feature directly and avoiding exposing port 32400 to the internet. The original flaw was reported to the company on July 27 by a researcher who received a monetary reward for the discovery. "It was not about asking a language model to hack Plex. It was hours of iterative work, dead ends, and reordering priorities," wrote the researcher, although he clarified that the decisions on what to prioritize were his own. Plex did not immediately respond to inquiries from the specialized press regarding the total extent of the compromised servers.