Attackers have started exploiting a chain of four vulnerabilities in Plex Media Server, collectively called Plex2Shell, to run code on exposed servers without logging in. According to The Hacker News, exploitation attempts began about a day after researcher Zach Main published technical details and a proof-of-concept on October 16. Plex Media Server is software people run on a home computer or NAS, and it is often reachable from the internet on port 32400 so owners can stream remotely.
The chain combines two server-side request forgery flaws (CVE-2026-96652 and CVE-2026-96655), an issue that exposes the owner’s admin token (CVE-2026-96654), and a file-path flaw that lets an attacker drop and run a shared library on the server (CVE-2026-96656, CVSS 8.6). A fifth flaw, CVE-2026-96651, was disclosed alongside them. All were reported to Plex on July 27 and patched in Plex Media Server 1.43.3.10861, released August 3, 2026. A researcher who goes by boredhackerblog observed in-the-wild attacks that downloaded an XMRig cryptominer and a Linux reverse-proxy backdoor, “myawesomeproxy”, which routes the attacker’s traffic through the victim’s connection. Reddit posts describe Plex users finding the same miner, though it is not yet known whether those cases stem from Plex2Shell.
How to check if you’re affected
Affected versions are Plex Media Server builds older than 1.43.3.10861. Open your Plex web interface and check the Plex Media Server version under Settings. If it is older than 1.43.3.10861, update through Plex’s downloads page or your NAS package source, since NAS packages can lag behind. Our earlier coverage of the September security notice is in Plex Urges Immediate Update to Fix Multiple Security Flaws.
Servers that were reachable from the internet while unpatched deserve a closer look. Signs reported in the wild include an unexplained process named mylovelyminer or myawesomeproxy and outbound connections to ota.proxystream[.]st or 217.60.194[.]116. If you find them, treat the server as compromised: update, remove the malware, and change your Plex password and any credentials stored on that machine. Consider whether remote access on port 32400 is needed at all. The Hacker News says it asked Plex for comment and had not heard back at publication.