Plex2Shell Vulnerabilities Exploited to Deploy Crypto Miners and Linux Proxy Backdoor

October 20, 2026 — Cybersecurity researchers have reported active exploitation of a chain of vulnerabilities in Plex Media Server, with attackers deploying cryptocurrency-mining software and a Linux-based reverse proxy backdoor. The activity was observed shortly after technical details of the vulnerability chain became public, raising concerns about internet-exposed servers that have not received security updates.

The vulnerability chain, known as Plex2Shell, combines four security flaws that researchers say can enable unauthenticated remote code execution on susceptible Plex Media Server installations. The findings were reported by The Hacker News on October 19, 2026.

What Is the Plex2Shell Vulnerability Chain?

Plex2Shell refers to a combination of vulnerabilities affecting Plex Media Server. According to the published research, attackers can chain the flaws to move from unauthenticated requests toward executing malicious code on a vulnerable server.

The four reported vulnerabilities are:

• CVE-2026-96652 — CVSS 5.3: An unauthenticated server-side request forgery (SSRF) vulnerability.
• CVE-2026-96654 — CVSS 6.9: A flaw involving URL handling that could enable unauthorized plugin-function calls and exposure of an administrative token.
• CVE-2026-96655 — CVSS 5.3: An SSRF vulnerability that can allow requests to internal or external destinations when the required authorization is available.
• CVE-2026-96656 — CVSS 8.6: A file-path handling vulnerability that can allow a malicious shared object to be written to an attacker-selected location and executed.

The significance lies in how the weaknesses can be combined. Rather than relying on a single flaw, the reported chain links multiple security failures to achieve a more serious outcome: remote code execution without prior authentication on affected installations.

Cryptocurrency Miners and a Linux Proxy Backdoor

Researchers observed attacks delivering a cryptocurrency miner identified as XMRig, with the process reportedly named mylovelyminer. Cryptocurrency-mining malware can consume a server’s CPU resources to generate digital currency for an attacker, potentially causing increased electricity costs, degraded performance and reduced service availability.

The activity also involved a Linux artifact named myawesomeproxy. According to the published analysis, this software operates as a reverse proxy and backdoor, potentially allowing compromised systems to be used to relay network traffic.

That second payload presents a different risk from cryptojacking. A compromised server may be repurposed as part of an attacker-controlled network, potentially exposing the system owner’s internet connection to external misuse. It may also complicate incident investigations because malicious traffic can appear to originate from the victim’s infrastructure.

The researchers also reported links between infrastructure associated with the activity and a domain previously flagged in connection with the AISURU DDoS and proxyware botnet. However, an infrastructure overlap alone does not establish that the same operators conducted both campaigns.

Disclosure and Patch Timeline

Security researcher Zach Main reportedly disclosed the vulnerabilities to Plex on July 27, 2026. Plex Media Server version 1.43.3.10861 was released on August 3, 2026, and was identified in the reporting as containing the relevant fixes.

Public technical details of the Plex2Shell chain appeared on October 16, followed by reports of exploitation activity. The short interval illustrates how publicly available vulnerability research can accelerate attempts to compromise systems that remain unpatched.

Separate online reports have also described Plex servers affected by a similar cryptocurrency-mining payload. Researchers have not confirmed that every reported compromise resulted from the Plex2Shell vulnerabilities, so those incidents should not automatically be attributed to the same attack campaign.

How Plex Server Administrators Can Reduce Risk

Administrators should treat the reported activity as a reason to review their Plex deployments and security controls.

Recommended defensive measures include:

1. Update Plex Media Server: Install the latest supported release available for your operating system or NAS platform. Do not assume that a server is protected merely because it was updated months ago.
2. Review internet exposure: Avoid exposing administrative interfaces or services to the public internet unless necessary. Restrict remote access to trusted users and networks wherever practical.
3. Inspect system activity: Investigate unexplained CPU usage, unfamiliar processes, unexpected outbound connections and unrecognized files in application directories.
4. Review logs: Look for unusual requests, unexpected authentication activity and other indicators that may suggest exploitation. Compare findings with trusted vendor and security-researcher advisories.
5. Respond to suspected compromise: Isolate an affected server where practical, preserve relevant logs and evidence, rotate credentials and tokens that may have been exposed, and rebuild from a trusted source if system integrity cannot be established.

Updating is essential, but it should not be treated as proof that a previously compromised system is clean. Administrators should investigate suspicious activity even after applying the relevant fixes.

Conclusion

The Plex2Shell reports demonstrate how multiple vulnerabilities in a widely deployed media server can be combined to create a serious security risk. The reported delivery of cryptocurrency miners and a Linux proxy backdoor highlights the possibility that compromised media servers may be used for both financial gain and unauthorized network activity.

For home-lab operators, businesses and NAS administrators, the immediate priorities are to install current security updates, reduce unnecessary exposure and investigate signs of compromise. As exploitation activity develops, defenders should follow updates from Plex and reputable cybersecurity researchers rather than relying on outdated software or unverified indicators.

Sources: The Hacker News — Plex2Shell exploitation report | Plex Media Server release announcement | Plex2Shell research disclosure