A chain of four vulnerabilities in Plex Media Server, dubbed Plex2Shell, is already being exploited in the wild, less than 24 hours after a researcher published technical details and proof-of-concept code. The rapid turnaround underscores how quickly public exploit code can be weaponized against exposed internet-facing software.
The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, can be combined to achieve unauthenticated remote code execution on a vulnerable Plex server. Code executed through the chain runs with the same privileges as the Plex service itself, giving attackers a direct foothold on affected hosts without needing valid credentials.
Disclosure and Patch Timeline
The vulnerabilities were reported to Plex on July 27. The company confirmed the issues and awarded a bug bounty on August 4, then announced on September 1 that fixes had already shipped, urging server operators to upgrade. The researcher who discovered the bugs released a full write-up and working PoC on October 16.
Observed Exploitation
A separate researcher running an internet-facing Plex honeypot on a vulnerable release detected the first confirmed in-the-wild exploitation on October 17. Prior to that date, the decoy server had only logged reconnaissance scans and generic probing. The researcher said attackers appeared to be using the publicly released exploit, possibly with minor modifications.
Once inside, attackers deployed a cryptocurrency miner built on XMRig. Later the same day, a second payload appeared on the honeypot: a program identified as proxy software called myawesomeproxy, which displays a notice indicating that operators consent to their internet traffic potentially being used by others.
The researcher noted that because many Plex servers run on residential IP addresses, threat actors likely see value in building a residential proxy network, which can be used to mask malicious traffic or gain less-scrutinized access to corporate VPNs and email systems.
Recommendations
Plex has reiterated that all server owners should install the latest release without delay. Given that exploitation began within a day of public disclosure, organizations and individuals running internet-exposed Plex instances should treat patching as urgent and review systems for signs of unauthorized mining processes or unexpected proxy software.
