By Plex Media Server is being actively exploited right now. On October 17, a security researcher confirmed live attacks against internet-facing Plex instances using a chain of four vulnerabilities called Plex2Shell — less than 24 hours after a public proof-of-concept dropped. The attack requires no login. If your server runs any version below 1.43.3.10861, it is a target.
Plex2Shell: Four CVEs, No Login Required
Plex2Shell chains four separate flaws into one unauthenticated remote code execution path. It starts with a server-side request forgery flaw via the /player/timeline endpoint (CVE-2026-96652, CVSS 5.3), where the protocol parameter accepts unvalidated input and forces the server to POST to any destination. From there, a URL neutralization flaw in the searchOne endpoint (CVE-2026-96654, CVSS 6.9) lets the attacker extract the owner’s admin token — without any credentials.
With that stolen token, CVE-2026-96655 enables authenticated SSRF through the transcode path. The final link — and the most dangerous — is CVE-2026-96656 (CVSS 8.6), which allows writing an ELF shared object to an attacker-chosen path in the Codecs directory. Plex loads that library during transcoding and executes it. SSRF to token theft to file write to code execution, start to finish, with no account required. Researcher Zach Main published a full technical write-up alongside the proof-of-concept on October 16.
Related: GitLab CVE-2026-97229: Unauthenticated RCE — Patch Now
What Attackers Deploy on Compromised Servers
Once attackers achieve RCE, they drop two payloads simultaneously. The first is a rebranded XMRig miner named mylovelyminer — it pins your CPU mining Monero while your system crawls. Users on Reddit and Neowin started noticing machines running hot and slow before understanding why. The second payload, myawesomeproxy, is more insidious: it converts your home or VPS IP into a residential proxy sold on underground markets to bypass bot detection systems. Your internet connection, your electricity bill, someone else’s revenue stream.
Both payloads persist beyond a service restart. Malicious .so files written to the Codecs directory re-execute whenever Plex transcodes. Stopping and restarting the Plex service does not remove the infection.
The Patch Existed for 75 Days. 36,000 Servers Didn’t Apply It.
Plex received the vulnerability report on July 27 and shipped the fix on August 3 (version 1.43.3.10861). The Shadowserver Foundation scanned the internet on September 9 — six weeks after the patch — and found over 36,000 instances still on vulnerable versions, out of approximately 300,000 total exposed Plex servers. When the full PoC went public on October 16, many of those servers remained unpatched. Exploitation began within 24 hours.
This is the self-hosted patching failure on display. Plex issued an urgent advisory. Security outlets covered it. The CVEs were in the database. None of it moved fast enough. The lesson is direct: an internet-facing self-hosted server is a production server. It requires production-grade patching discipline — not “I’ll get to it eventually.” The weaponization timeline between PoC publication and active exploitation has been shrinking for years. 24 hours is now the window, not the exception.
How to Check for Compromise and Apply the Patch
If your Plex instance is accessible from the internet, check for compromise before patching. Run the following commands on Linux or inside your Docker container:
# Check for active compromise indicators
ps axjf | grep -E "myawesomeproxy|mylovelyminer|x12345|proxystream"
# Inspect Codecs directory for unexpected shared libraries
ls -la "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs/"Look for processes named myawesomeproxy, mylovelyminer, or x12345, and command-line arguments referencing --rig-id, --donate-level, or proxystream.st. If any are present, the server is compromised — stop Plex, clean the Codecs directory, then rebuild from a clean state before applying the patch. Simply patching an already-compromised server leaves the old payloads running.
To patch, update to Plex Media Server 1.43.3.10861 or newer. Downloads are available at plex.tv/media-server-downloads. Verify your current version under Settings → Troubleshooting → Diagnostics. If your install method supports automatic updates, enable them — the next public PoC will not give you six weeks.
Key Takeaways
- Plex2Shell chains four CVEs into unauthenticated RCE — no credentials or user interaction required
- Active exploitation started October 17, 2026; attackers deploy an XMRig cryptominer and a residential proxy backdoor simultaneously
- The patch (1.43.3.10861) shipped August 3 — over 36,000 servers were still unpatched six weeks later when exploitation began
- Check for compromise before patching: look for mylovelyminer, myawesomeproxy, and unexpected .so files in the Codecs directory
- Internet-facing self-hosted services require the same patching urgency as production infrastructure
