Attackers Chain Plex Server Flaws to Deploy Miners and Proxy Backdoor

First reported 19 Oct, 17:32 UTCSource: The Hacker NewsLast editorial activity 19 Oct, 17:32 UTCWrite a comment ↓

Unbranded hardware wallet on a dark wooden desk next to a notebook — WORLDTECH illustration · AI-generated (Canva)

Threat actors have started exploiting a chain of flaws in Plex Media Server to install cryptocurrency miners and reverse proxy software, according to a report in The Hacker News. The activity followed the public release of a proof-of-concept exploit by one day.

How the flaw chain works

According to a researcher who uses the online alias boredhackerblog, the attacks chain four vulnerabilities that together are called Plex2Shell. Taken in sequence, the flaws can be combined to achieve unauthenticated remote code execution on vulnerable Plex Media Server instances.

The first weakness is a server-side request forgery in the player timeline endpoint, which lets an attacker make the server send requests to a destination of their choosing. A second server-side request forgery, which requires an authenticated user, can reach internal or external addresses through the universal transcode path. A further flaw permits an attacker to load a shared object file into the Codecs directory and execute it, while another lets an attacker call functions of other plugins and obtain the owner's admin token.

Disclosure and patch timeline

The vulnerabilities were reported to Plex on July 27, 2026 by security researcher Zach Main. Plex fixed them in Plex Media Server 1.43.3.10861, released on August 3, 2026.

Exploitation activity was recorded after technical details of the chain became public on October 16, 2026. The attacks led to the deployment of a miner payload fetched from a remote server. Running the program also displays a message stating that using the software means agreeing to potential external use of the user's internet traffic.

What remains unclear

The report does not establish whether the vulnerabilities were part of a separate alert that was also mentioned. The sources reviewed rely on a single named outlet and on a researcher's description of the exploitation, so the full scope of the campaign has not been independently confirmed.

Open questions

Are the vulnerabilities linked to a separate alert that has also been reported?
How many Plex Media Server instances have been compromised so far?

Key facts

Threat actors have begun exploiting a chain of vulnerabilities in Plex Media Server.

The attacks aim to deploy cryptocurrency miners and reverse proxy software.

Exploitation began a day after a proof-of-concept for the chain went public on October 16, 2026.

The vulnerabilities were disclosed to Plex on July 27, 2026 by researcher Zach Main.

They were patched in Plex Media Server 1.43.3.10861, released on August 3, 2026.