{"id":3613,"date":"2026-10-19T19:36:10","date_gmt":"2026-10-19T19:36:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3613"},"modified":"2026-10-19T19:36:10","modified_gmt":"2026-10-19T19:36:10","slug":"hackers-exploit-plex2shell-flaws-to-install-crypto-miners-and-linux-proxy-backdoor","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3613","title":{"rendered":"Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 19, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjF_Xo8mH5AxIDYx4hFrS1_uhblD0IoGUTo6bioM38mwy-whZAbcq1aaGeH1iZrS8nmk5Ow25NfX67HRXKiWFfzLc8C1A2zs2n948DwyW_NSSkowFDnEzxUofGxhNV72vTEWkgPmbO6XJyDUPwBR-lzSekj5_m8tY3JHjozUXETGEBg6GrLZrekhilW9W_R\/s1700-nu-rw-lo-l85-e365\/plex-hack.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.<\/p>\n<p>According to a researcher who goes by the online alias <a href=\"https:\/\/www.boredhackerblog.info\/2026\/10\/plex-vulnerabilities-being-exploited-in.html\" target=\"_blank\">boredhackerblog<\/a>, the exploitation activity involves chaining four different vulnerabilities, collectively called <strong><a href=\"https:\/\/github.com\/code-zm\/plex2shell\/\" target=\"_blank\">Plex2Shell<\/a><\/strong>.<\/p>\n<p>The vulnerabilities are below &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-96652\" target=\"_blank\">CVE-2026-96652<\/a><\/strong> (CVSS score: 5.3) &#8211; An unauthenticated server-side request forgery (SSRF) stemming via the \u00ab\/player\/timeline\u00bb endpoint by taking advantage of the fact that the \u00abprotocol\u00bb parameter is inserted into a programmatically-constructed player URL with no validation, allowing an attacker to force the Plex server to POST to a destination of their choice.<\/li>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-96654\" target=\"_blank\">CVE-2026-96654<\/a><\/strong> (CVSS score: 6.9) &#8211; An improper neutralization of URL values included in the \u00absearchOne\u00bb endpoint that could allow an attacker to call other plugins&#8217; functions and supply their own parameters to obtain the owner&#8217;s admin token.<\/li>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-96655\" target=\"_blank\">CVE-2026-96655<\/a><\/strong> (CVSS score: 5.3) &#8211; An SSRF vulnerability that allows an authenticated user (i.e., the owner token) to request arbitrary internal or external addresses (e.g., an attacker-hosted carrier video carrying the malicious ELF payload) via the &#8216;\/video\/:\/transcode\/universal&#8217; path parameter.<\/li>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-96656\" target=\"_blank\">CVE-2026-96656<\/a><\/strong> (CVSS score: 8.6) &#8211; An external control of file name or path vulnerability that allows the ELF shared object to an attacker-chosen path in the Codecs directory and execute it.<\/li>\n<\/ul>\n<p>Put differently, the vulnerabilities can be combined together in this order to achieve unauthenticated remote code execution on susceptible Plex Media Server instances.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-agent-methods-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh-69Sxi6ukfnlM_EpqEB_hRVymcXAcWTNAJetA9huKutPZuG0OOBUvByDCtP_HokC-gM-AzjX0ZhgneUFVzjCyIduRINFj6Yf0JXRFE17_z82UioyT9eoxH2-XQDoD_hInCxc8V2bQrmtnMN-GUR63bseKn7pLRISqlvUJlfuJq8pgCL-Fot7sQDas9D05\/s728-nu-rw-lo-l85-e365\/nudge-3-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The vulnerabilities, along with <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-96651\" target=\"_blank\">CVE-2026-96651<\/a> (CVSS score: 7.1), were <a href=\"https:\/\/zmain.info\/blog\/plex2shell\" target=\"_blank\">disclosed<\/a> to Plex on July 27, 2026, by security researcher Zach Main, and were patched in <a href=\"https:\/\/forums.plex.tv\/t\/plex-media-server\/30447\/712\" target=\"_blank\">Plex Media Server 1.43.3.10861<\/a> released on August 3, 2026.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>In-the-wild exploitation attempts targeting the flaws have since been recorded a day after technical details of the Plex2Shell chain went public on October 16, 2026. The attacks led to the deployment of a miner payload from a remote server (\u00ab217.60.194[.]116\u00bb).<\/p>\n<p>The attack efforts have been observed from the following IP addresses &#8211;<\/p>\n<ul>\n<li>91.92.40[.]202<\/li>\n<li>176.65.139[.]228<\/li>\n<li>45.194.92[.]222<\/li>\n<li>176.65.139[.]228<\/li>\n<\/ul>\n<p>Furthermore, the vulnerabilities have been exploited to deliver an artifact named \u00abmyawesomeproxy,\u00bb which, according to <a href=\"https:\/\/www.virustotal.com\/gui\/file\/e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9\/detection\" target=\"_blank\">VirusTotal<\/a>, is a stealthy Linux backdoor and reverse proxy. Running the program displays the below message, per boredhackerblog &#8211;<\/p>\n<p><em>Running this software on any of your devices makes you agree to the potential external use of your internet traffic.<\/em><\/p>\n<p>Also deployed concurrently is an XMRig miner process identified as \u00abmylovelyminer\u00bb with its <a href=\"https:\/\/xmrig.com\/docs\/miner\/command-line-options\" target=\"_blank\">mining server<\/a> pointing to \u00ab<a href=\"https:\/\/www.virustotal.com\/gui\/domain\/ota.proxystream.st\" target=\"_blank\">ota.proxystream[.]st<\/a>.\u00bb Notably, another subdomain associated with the same domain, \u00ab<a href=\"https:\/\/www.virustotal.com\/gui\/domain\/global.relay.proxystream.st\" target=\"_blank\">global.relay.proxystream[.]st<\/a>,\u00bb was <a href=\"https:\/\/www.bitsight.com\/blog\/who-invited-aisuru-lan-party\" target=\"_blank\">flagged by Bitsight<\/a> in August 2026 in connection with the AISURU DDoS and proxyware <a href=\"https:\/\/www.cloudflare.com\/learning\/ddos\/glossary\/aisuru-kimwolf-botnet\/\" target=\"_blank\">botnet<\/a>.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Posts on Reddit <a href=\"https:\/\/www.reddit.com\/r\/PleX\/comments\/1x95krg\/inthewild_exploitation_of_old_plex_servers\/\" target=\"_blank\">indicate<\/a> that multiple Plex users have had their instances compromised with the same \u00abmylovelyminer\u00bb payload. That said, it&#8217;s not known at this stage if it stems from the exploitation of Plex2Shell flaws.<\/p>\n<p>The development comes more than a month after Plex urged users to update their instances to the latest version following the release of an update that addressed multiple unspecified security flaws.<\/p>\n<p>It&#8217;s unclear if the aforementioned vulnerabilities were part of this alert. The Hacker News has contacted Plex for comment and we will update the story if we hear back. In light of active exploitation, users are advised to keep their Plex installations up-to-date for optimal protection.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 19, 2026Vulnerability \/ Web Security Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3614,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[179,143,120,11,338,1779,181,1038,3842,354],"class_list":["post-3613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-backdoor","tag-crypto","tag-exploit","tag-flaws","tag-hackers","tag-install","tag-linux","tag-miners","tag-plex2shell","tag-proxy"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3613"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3614"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}