Hackers use Plex2Shell to install miners and proxies on Plex servers

First reported by Cyber Security News at · Updated · 8 sources

The publicly released exploit combines four vulnerabilities in Plex Media Server, allowing attackers to run code without logging in. Researchers have observed attacks against unpatched servers. Cyber Security News reports that a researcher recorded successful exploitation against a honeypot on October 17, 2026, following the exploit's release.

  • Security Affairs urges administrators to update Plex Media Server.

Covered by 8 publishers within 41 hours of the first report.

Reporting8

Cyber Security News Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware · Guru Baran
SecurityWeek Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure · Eduard Kovacs
Gizmodo Your Plex Server Could Be Mining Crypto for Hackers · Kyle Torpey
Neowin Users confirm Plex running slow and hot due to malicious cryptominers · Sayan Sen
The Hacker News Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor · info@thehackernews.com (The Hacker News)
Security Affairs Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners · Pierluigi Paganini
Ars Technica PSA: Patch your Plex media server before someone hacks it · Dan Goodin
TechSpot Update now: Hackers are exploiting Plex server vulnerabilities to install malware · Ivan Franco

Related

Hackers linked to Korean bank attacks leave their own tools exposed
Claude Code finds hidden crypto miner while building a Mac monitoring app
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Ledger confirms tampered CryptoBilis wallets exposed recovery phrases

Topics Crypto