Cybersecurity
Plex flaws used to install miners and backdoor
Researchers said four Plex Media Server flaws could be chained to break into exposed instances, and the article said attackers had already used them to install miners and a proxy backdoor.
- A researcher using the alias boredhackerblog said four Plex Media Server vulnerabilities could be chained to reach unauthorised remote code execution.
- Security researcher Zach Main disclosed those flaws, together with CVE-2026-96651, to Plex on 27 July 2026, and Plex patched them in version 1.43.3.10861 on 3 August 2026.
- The article said exploitation attempts began a day after the technical details were published on 16 October 2026.
- One campaign fetched a miner payload from 217.60.194.116, and the observed attack IPs included 91.92.40.202, 176.65.139.228 and 45.194.92.222.
- The same activity also delivered myawesomeproxy, which VirusTotal identified as a Linux backdoor and reverse proxy, and mylovelyminer, an XMRig miner pointing to ota.proxystream.st.
Researchers said the chain, dubbed Plex2Shell, combined four Plex Media Server flaws that together allowed an attacker to execute code on vulnerable systems without authentication. The article listed the issues as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
Zach Main had disclosed those vulnerabilities to Plex on 27 July 2026, along with CVE-2026-96651. Plex released Plex Media Server 1.43.3.10861 on 3 August 2026 to address them.
The article said exploitation attempts were seen after the technical details were made public on 16 October 2026. Those attacks were said to have pulled a miner payload from 217.60.194.116.
The same activity was also said to have delivered myawesomeproxy, which VirusTotal identified as a Linux backdoor and reverse proxy, and an XMRig miner called mylovelyminer. The miner pointed to ota.proxystream.st.
Posts on Reddit suggested that other Plex users had also been compromised with the same miner payload, but the article said it was not yet known whether those cases came from the Plex2Shell exploitation. The article also said Plex had urged users to keep their installations updated after an earlier patch for unspecified flaws.
Named in this story
People
- boredhackerblog
- The researcher alias that described the exploitation chain
- Zach Main
- The security researcher who disclosed the flaws to Plex
Companies
- Plex
- The company that received the disclosure and released a fix
- Bitsight
- The security company that had flagged a related subdomain in August 2026
Organisations
- VirusTotal
- The service that identified myawesomeproxy as a backdoor and reverse proxy
Products and systems
- Plex Media Server
- The software whose flaws were chained by attackers
- myawesomeproxy
- The deployed file described as a Linux backdoor and reverse proxy
- XMRig
- The mining software used in the payload identified as mylovelyminer
- mylovelyminer
- The miner process deployed alongside the proxy payload
How the source tells it
A technical security report that stays mostly factual but uses active-exploitation and update-now wording to create urgency.
- urgency The piece foregrounded live exploitation and closed with advice to update immediately