Affected Systems

Plex Media Server versions prior to 1.43.3.10861. The Plex2Shell chain combines four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to achieve unauthenticated remote code execution. All internet-exposed Plex Media Server instances running unpatched versions are vulnerable.

Exploitation Status

Active exploitation confirmed. Attacks began one day after public PoC release on October 16, 2026. Threat actors deploying XMRig cryptocurrency miners ("mylovelyminer") and reverse proxy backdoor ("myawesomeproxy"). Attack traffic observed from IPs: 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222, and payload server 217.60.194[.]116. Multiple Plex users on Reddit report compromise.

Business Impact

Unauthenticated RCE allows complete server compromise. Attackers gain ability to execute arbitrary code, deploy persistent backdoors, and consume system resources for cryptomining. The reverse proxy backdoor ("myawesomeproxy") enables attackers to route malicious traffic through compromised servers, potentially implicating organizations in downstream attacks. Plex servers often run on internal networks with access to media storage and may have elevated privileges. Patch available since August 3, 2026, but exploitation window remains open for unpatched instances.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately update Plex Media Server to version 1.43.3.10861 or later on all instances
  • Audit Plex servers for indicators of compromise: check for processes named 'mylovelyminer' or 'myawesomeproxy', inspect Codecs directory for unexpected ELF binaries, review outbound connections to 217.60.194[.]116 and domain proxystream[.]st
  • Block inbound connections from known attack IPs: 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222 at perimeter firewalls
  • Restrict Plex Media Server exposure to the internet; place behind VPN or use Plex's built-in authentication with strong credentials if remote access is required
  • Monitor for unusual CPU usage spikes, unexpected network traffic to mining pools, and unauthorized modifications to the Plex Codecs directory

---

# Threat Actor Context

Actor Profile

boredhackerblog is a security researcher who identified active exploitation of the Plex2Shell vulnerability chain. The actual threat actors exploiting these flaws remain unattributed, though their motivation appears financially driven, deploying cryptocurrency miners (XMRig) and reverse proxy backdoors ("myawesomeproxy") on compromised Plex Media Server instances. The exploitation began within 24 hours of the Plex2Shell proof-of-concept being publicly released on October 16, 2026, indicating opportunistic actors monitoring vulnerability disclosures for rapid weaponization.

TTPs (Tactics, Techniques, Procedures)

The threat actors chain four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) to achieve unauthenticated remote code execution on Plex Media Server instances. Initial access leverages an unauthenticated SSRF (T1190 - Exploit Public-Facing Application) via the "/player/timeline" endpoint, followed by admin token theft through improper URL neutralization in the "searchOne" endpoint. Authenticated SSRF retrieves attacker-hosted ELF payloads via the transcode path, and path traversal enables execution of malicious shared objects in the Codecs directory (T1059 - Command and Scripting Interpreter). Post-exploitation includes deployment of XMRig cryptocurrency miners (T1496 - Resource Hijacking) and reverse proxy backdoors for persistence and traffic tunneling (T1090 - Proxy). Infrastructure includes C2 at 217.60.194[.]116 and mining server ota.proxystream[.]st, with connections to the AISURU DDoS/proxyware botnet.

Targets & Patterns

The threat actors target Plex Media Server instances, primarily affecting media streaming environments and general computing users running vulnerable versions prior to 1.43.3.10861. The targeting appears indiscriminate and opportunistic rather than sector-specific, focusing on internet-exposed Plex servers that have not applied patches released on August 3, 2026. Multiple Reddit reports indicate widespread compromise of home and small business Plex installations. The choice of targets reflects a financially motivated strategy: Plex servers often run on systems with adequate computing resources for cryptocurrency mining and maintain persistent internet connectivity suitable for proxy/botnet operations. Attack sources include IP addresses 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222.

Historical Context

The Plex2Shell vulnerabilities were disclosed to Plex by security researcher Zach Main on July 27, 2026, and patched in version 1.43.3.10861 on August 3, 2026. Active exploitation commenced on October 17, 2026, one day after the proof-of-concept was publicly released on October 16, 2026. The infrastructure domain global.relay.proxystream[.]st was previously flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet, suggesting potential links between current exploitation activity and established botnet operations. Plex had issued an earlier advisory urging users to update following unspecified security fixes, though it remains unclear if the Plex2Shell vulnerabilities were part of that alert. This represents a pattern of rapid post-disclosure exploitation common to publicly available proof-of-concept code.

Defensive Recommendations

  • Immediately update Plex Media Server to version 1.43.3.10861 or later to remediate CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656
  • Monitor network traffic for connections to known malicious infrastructure: 217.60.194[.]116, ota.proxystream[.]st, global.relay.proxystream[.]st, and source IPs 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222
  • Inspect Plex Codecs directories for unexpected ELF shared objects, particularly files named 'mylovelyminer' or 'myawesomeproxy', and check for unauthorized XMRig miner processes
  • Implement network segmentation to limit Plex Media Server exposure to the internet; use VPN or reverse proxy with authentication for remote access rather than direct exposure
  • Enable logging for SSRF attempts targeting /player/timeline, /searchOne, and /video/:/transcode/universal endpoints, and alert on anomalous POST requests or admin token access patterns (T1190 detection)