Four Plex2Shell CVE allows remote execution and mining and proxy backdoor deployment

In recent days, an increase in attacks has been confirmed that take advantage of a chain of failures in Plex Media Server - nicknamed "Plex2Shell" by researchers - to run code remotely and deploy both cryptomineros and a proxy / reverse with back door functionality. The judgements, originally reported to Plex on 27 July 2026 and corrected in version 1,43.3.10861 published on 3 August 2026, have been combined by attackers following the public publication of a proof-of-concept (PoC) on 16 October 2026, and attempts at exploitation were recorded in nature the following day.

What has happened (confirmed facts): a researcher operating under the pseudonym boredhackerblog described a chain of four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) that, chained in a specific order, allow to move from an unvalidated web request to a remote execution of code without authentication in vulnerable instances of Plex. Plx released a patch in version 1.43.3.10861 to correct these failures. Then there were attempts to operate that resulted in the discharge and execution of two artifacts: a binary called "myawesomeproxy" - identified by public analysis as a backdoor / reverse-proxy for Linux - and an XMRig mining process under the name "mylovelyminer" that contacted the ota.proxystream domain [.] st. Analysts have also correlated network activity with public IP addresses used by the attackers (e.g. 217,60.194.116 and the PIs 91,92.40,202, 176,65.139.228, 45,194.92.222).

How the chain works technically: each satellite CVE provides a link to scale from an initial request to the execution of an ELF controlled by the attacker. Summarizing its role, without playing the blast step by step: one of the failures allows parameters controlled by the attacker to be inserted into a URL used by the Plx player (SSRF in / player / timeline), another allows to invoke plugin functions and get the owner's token (token escape via / searchOne), a third allows a valid token to request arbitrary resources (SSRF in the transcoding route), and the latter allows to write an ELF shared object in the Codecs folder and to force its load and execution. In chains, these vectors convert a malicious web request into remote execution without the need for credentials.

Who it affects: Plex Media Server instances that have not been updated and are accessible from the network (Internet or an internal network not segmented). The risk is higher in servers with exposed ports, in facilities that allow automatic installation of codecs or plugins, or in environments where the Plex process runs with high privileges or with the ability to write on its own file tree.

Observed impact: deployment of an XMRig cryptominer and a proxy with back door functionality. The proxy ("myawesomeproxy") reports when starting with a message that, according to the researcher, warns that the software can use the host's network traffic; it is an operational confirmation that the engaged machine can be reused as an exit / relay jump for foreign traffic. In addition, links between proxystream [.] st subdomains and previous botnets / proxyware activities have been documented by third parties (e.g. safety reports that relate global.relay.proxystream [.] st to AISURU campaigns in August 2026).

What is confirmed and what is not: is confirmed that there are EQs and the public patch, that activity was observed in the network following the publication of the PoC and that the artifacts mentioned above were downloaded / executed from the indicated directions and domains. It is not confirmed, for now, that all instances reported by users in forums - like several threads in Reddit that mention "mylovelyminer" - come specifically from the Plex2Shell chain; there are cases in which cryptoming campaigns reuse multiple vectors. Nor is there a public and verified attribution of the responsible actor or absolute certainty about the complete scale of infections beyond the publicly observed indicators.

For those who prefer official technical references, associated CVE records are already published on public bases such as MITRE ( CVE-2026-96652, CVE-2026-96656) and Plex keeps its download and update page on https: / / www.plex.tv / media-server-download /. To understand the technical mining piece, XMRig (the mining software generally detected in these campaigns) documents its connection protocol in https: / / xmrig.com.

What the administrator or user of Plx should do: first and urgently check the version of Plx Media Server; if it is before 1,43.3.10861, immediately update to the parched version or to a later version. If the instance is exposed to the Internet, isolate the service until updated. If you suspect commitment, proceed with these specific actions: (1) disconnect the machine from the external network; (2) perform a forensic memory overturn and a disk image if you have analysis capabilities; (3) search for processes with unusual names (e.g. "mylovelyminer," "myawesomeproxy") and outgoing connections to the indicated domains / PIs; (4) inspect Plex directories for unauthorised ELF files within the Codens folders (see the typical location in their distribution; e.g. in Linux it is usually under the Plex data tree / PIs indicated; and (6) to reinstall the non-stop-stop-stop-stop-stop, and-stop-stop-stop-stop-stop-and-stop-stop-stop-stop-stop-stop-stop-and-stop-stop-stop-stop-stop-stop-stop-and-stop-stop-stop-stop-stop-stop-stop-and-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-stop-and-stop-stop-stop-and-stop-stop-stop

In parallel, apply prevention controls: it restricts access to the Plex server by firewall (allowing only reliable networks), disable UPnP / auto-port-forwarding in routers, put Plex behind a VPN or proxy inverse that makes prior authentication and limits the privileges of the user running Plex to avoid writing in their own critical directories. Record and monitor frequent outgoing connections to known IOC (PIs and domains cited above) and block them in perimeter.

Finally, document and report any findings: if you detect evidence of commitment, capture logs, notify your hosting provider if you apply and compare indicators with public intelligence sources before trying a local remediation. The speed of applying patches and network segmentation remain the most effective barriers to these types of chains that transform validation failures into remote execution and illicit use of resources.