Attackers began exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, about one day after researcher Zach Main published full details and proof-of-concept code on GitHub. A honeypot report from the researcher known as BoredHackerBlog recorded the first attacks on October 17, with payloads that included the XMRig cryptominer and a proxy tool.
Plex2Shell Chain Gives Unauthenticated Code Execution on Plex Media Server
Main’s write-up describes four CVEs that, linked together, give an attacker unauthenticated remote code execution on a Plex Media Server. Three of the identifiers named in coverage are CVE-2026-96652, CVE-2026-96654 and CVE-2026-96656. None of the individual flaws scores above 7.2 on the CVSS scale, but chained together they require no valid login.
All four flaws affect Plex Media Server versions before 1.43.3.10861. Plex fixed the issues in that release weeks before the public disclosure.
How the Chain Steals the Admin Token and Runs Commands as the Plex Service User
The chain first steals the server owner’s admin token. With that token in hand, the attacker runs commands on the host as the Plex service user. Because the first step captures a credential instead of requiring one, the attacker never needs an account on the target server.
Four vulnerabilities rated at or below 7.2 can still combine into a pre-authentication code execution path, a pattern that scoring each flaw in isolation does not capture.
Honeypot Records Attacks From Three IP Addresses Within a Day
The BoredHackerBlog honeypot recorded attacks on October 17 from three IP addresses: 45.194.92.222, 91.92.40.202 and 176.65.139.228. The payloads were fetched from a separate address, 217.60.194.116, and included the XMRig cryptominer along with a proxy tool.
The timing is the notable detail. The chain moved from a published proof-of-concept to observed attacks in roughly one day, which leaves little room between a researcher’s public release and criminal use of it.
Why Residential Plex Servers Appeal as Proxies
Many Plex servers run on residential IP addresses. According to the coverage, that makes hijacked servers attractive as residential proxies, which attackers can use to reach corporate VPNs and email while appearing to connect from an ordinary home connection. The proxy tool seen in the honeypot payloads fits that use, alongside the cryptominer, which monetizes the server’s processing power directly.
The observed payloads are a cryptominer and a proxy tool. The honeypot report does not describe any other post-exploitation activity.
Disclosure Timeline: From July Report to Wild Exploitation
Main reported the bugs to Plex in July. On September 1, Plex warned users running versions 1.43.2 and earlier. Main then published the write-up and proof-of-concept code on October 16, and the first exploitation appeared in the honeypot the next day.
That sequence means a patched version was available for weeks before the exploit code went public. The exposure that remains comes from servers that were never updated. Home servers often do not auto-update, so a large pool of exposed Plex Media Server installations remains reachable and vulnerable to the chain.
CISA Has Not Listed the Plex Flaws as Known Exploited
As of the honeypot report, CISA had not added the Plex flaws to its Known Exploited Vulnerabilities catalog. The exploitation evidence so far rests on a single researcher’s honeypot report.
What Plex Server Owners Face After the Fix
Plex’s remedy is version 1.43.3.10861, and owners need to confirm which version their server is running. Servers on 1.43.2 and earlier remain within the range Plex warned about on September 1, and the advisory covers every release before the fixed build.
Plex Media Server sits in an unusual position among exploited software. It is consumer-oriented, often installed once and forgotten, and frequently exposed to the internet so that owners can stream remotely. Those habits explain why a cryptominer and a proxy tool are the first payloads seen: they need no sophistication from the attacker once code execution is available.
The coming days will show whether the attacks stay at opportunistic mining and proxying or whether other actors adopt the chain, and whether CISA adds the Plex CVEs to its catalog.
