Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers

Fubuki

TLDR: update ur shit, A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy. (Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.) Unless ur plex is on v1.43.3.10861 ur fine

---

poc: https://github.com/code-zm/plex2shell

A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities:

• CVE-2026-96652
• CVE-2026-96654
• CVE-2026-96655
• CVE-2026-96656
⠀
The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations.
⠀
Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections.
⠀
Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing:

• myawesomeproxy
• mylovelyminer
• x12345
• --rig-id
• --donate-level
• proxystream[.]st
⠀
Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes.
⠀
The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.

https://x.com/DarkWebInformer/status/2111849768729100292
https://x.com/IntCyberDigest/status/2111842662898688346
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

luckypenguin

lol, and people still pay $$$ for this shit.
I prefer my Jellyfin behind nginx basic-auth and list of authorized IPs.

Neoon

jellyfin uwu

LEBUserJoe

@luckypenguin said:
lol, and people still pay $$$ for this shit.
I prefer my Jellyfin behind nginx basic-auth and list of authorized IPs.

jellyfin just aint there yet sadly, or i'd agree, slow development bulky codebase aint helping

TimboJones

Kodi has the best playback, but absolutely the worst piece of shit ever written to use over VPN.

Jellyfin works well over VPN, but playback controls are garbage and stupid. No add-ons or fixes to configure that better that I'm aware of.

Jellyfin has an add-on for Kodi, but has the Kodi garbage performance and so it isn't a solution.

Plex is what I use remotely when playback controls are minimally used. But the broken downloads functionality makes Plex garbage for using on the road.

Given what Plex did recently in terms of UI and feature change, I'm expecting a vibe coded option in the near future aimed at Plex veterans.

rpqu

@TimboJones said:
Kodi has the best playback, but absolutely the worst piece of shit ever written to use over VPN.

Jellyfin works well over VPN, but playback controls are garbage and stupid. No add-ons or fixes to configure that better that I'm aware of.

Jellyfin has an add-on for Kodi, but has the Kodi garbage performance and so it isn't a solution.

Plex is what I use remotely when playback controls are minimally used. But the broken downloads functionality makes Plex garbage for using on the road.

Given what Plex did recently in terms of UI and feature change, I'm expecting a vibe coded option in the near future aimed at Plex veterans.

Just download to local storage and play locally