Plex2Shell Exploited to Deploy Miners, Linux Backdoor

Plex Media Server users who have not patched since August are now active targets. Attackers began exploiting a five-vulnerability chain in Plex Media Server on October 16, one day after a public proof-of-concept went live, according to The Hacker News. Compromised servers are being converted into XMRig-based cryptocurrency mining nodes and outfitted with a Linux proxy backdoor.

The patch has been available for two and a half months.

The vulnerability chain

All five flaws affect Plex Media Server before version 1.43.3.10861, released August 3, 2026. Security researcher Zach Main discovered the set and disclosed it to Plex in late July; Plex issued fixes within a week.

The highest-severity flaw is CVE-2026-96656 (CVSS 7.2, high). Per NVD, the TranscoderH264Options preference is appended verbatim to x264’s option string, and the server loads all .so files from the Codecs directory at startup without signature or symbol checks. That is the execution primitive at the end of the chain.

Getting there requires the supporting four. CVE-2026-96651 (CVSS 6.5, medium) is a path traversal in /system/agents/media/get that lets a remote attacker with a valid session token read any file the Plex process can access, including the PlexOnlineToken. CVE-2026-96652 (CVSS 4.3, medium) and CVE-2026-96655 (CVSS 4.3, medium) are SSRF entries in the /player/timeline and transcoder paths respectively. CVE-2026-96654 (CVSS 6.5, medium) covers the URL neutralization step.

Individually, none of those scores trigger a two-in-the-morning alert. Together, they describe a path to unauthenticated remote code execution on any exposed Plex server running a build from before August.

What attackers are deploying

The observed payloads are XMRig-based miners and a Linux reverse-proxy backdoor routing traffic to an external pool hosted at ota.proxystream[.]st. The pattern is consistent with opportunistic compromise of internet-exposed servers rather than targeted intrusion, but a backdoored server is a backdoored server regardless of the attacker’s original intent.

What to do

Patch to Plex Media Server 1.43.3.10861 or any later release. If immediate patching is not possible, restrict network access to the Plex management interface so it is not reachable from untrusted networks.

Plex installations exposed directly to the public internet are the primary risk here. Servers bound to a local network and protected by a firewall face substantially lower exposure, though patching remains the correct long-term answer regardless.

The two-and-a-half-month gap

The vulnerability was disclosed responsibly, the vendor patched promptly, and the PoC dropped ten weeks later. Exploitation followed within twenty-four hours of the PoC. That sequence is not unusual, but it lands hardest on self-hosted infrastructure where no one owns the patch schedule: home media servers, small office deployments, hobby setups running firmware that nobody updates until something breaks.

The window between a patch landing and an exploit circulating has been compressing for years. That is a piece of context worth keeping in mind when a self-managed server gets pushed to the back of the queue.

Related: AhsayCBS Backup Platform Exploited, No Patch Ready / Langflow RCE Draws 1,423 Attacks: Patch to 1.9.0 / CVE-2026-110447: Collabora CODE Server Exploited