Researchers warn of active attacks on unpatched Plex media servers

Exploit chain 'Plex2Shell' delivers cryptominers and proxy malware to vulnerable devices

By LineZotpaper

Published19 October 2026

Read Time2 min

Attackers are actively exploiting recently fixed vulnerabilities in Plex Media Server to break into unpatched devices and install malware, according to a security researcher who tracked the attacks with a decoy server.

Recently fixed vulnerabilities in Plex Media Server are under active exploitation in attacks that, when successful, install malware including cryptominers and residential proxy applications, a security researcher has reported.

Plex released fixes for four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities in total, one of them carrying a severity rating of 8.6 out of 10. Last week, a researcher published details of an exploit chain that links four of the flaws together to achieve remote code execution on a device running a vulnerable version, naming the chain Plex2Shell.

The publication of those details allowed a separate researcher to set up a honeypot, a decoy server designed to attract attackers, to track attempts in the wild. Within a day, the honeypot was being actively scanned, and eventually attackers succeeded in infecting it.

So far, successful attacks are delivering two payloads. One is a cryptominer, which hijacks the device's processing power to mine cryptocurrency into a wallet controlled by the attacker. The other is residential proxy software, which lets people anonymise their internet activity, much of it illegal, by routing it through the infected device.

The practical takeaway for users is to patch promptly. Plex published the fixes at the start of last month, but the Plex2Shell chain means any server still running an outdated version now faces a documented and actively exploited attack path.

Analysis

Why This Matters

Plex Media Server runs on many always-on home and small-office devices, and users often leave such servers reachable from the internet to stream their libraries remotely, creating a broad attack surface.
A successful infection does real damage: the device's computing power is stolen for cryptocurrency mining, and the same device becomes a relay that routes other people's traffic, some of it illegal, through the victim's internet connection.
Because a working exploit chain is now public, the difference between safe and compromised may simply be whether the patches from last month have been installed.

Background

Plex Media Server is popular software for organising and streaming personal collections of films, TV shows and music across a user's own devices. Because the software is designed to be reachable over networks, many installations are exposed to the wider internet, which makes them attractive to automated scanning and attackers. Vulnerabilities in consumer-facing server software are a recurring category of security problem, since such devices tend to be left running around the clock with less attentive patching than corporate systems.

Key Perspectives

Security researchers: The Plex2Shell chain demonstrates that individual bugs can be stitched together into full remote code execution, and the honeypot shows attackers are already scanning for vulnerable servers and succeeding at infecting them.

Plex and its users: The fixes have been available since the start of last month, so the immediate remedy is straightforward: install the patched version and confirm no outdated builds are in use.

Critics and skeptics: The sequence of events, with fixes shipped but CVE designations published three weeks later and a public exploit chain soon after, gave attackers a working roadmap while many users had little clear signal of the urgency. The main concern now is the large population of unpatched servers and how quickly scanning campaigns can grow once exploit code is public.

What to Watch

Whether the researcher operating the honeypot publishes further data on the scale of exploitative scanning and infections.
Whether additional CVE designations or patches for the remaining vulnerabilities appear, and whether Plex takes further steps to push users onto patched versions.
Whether the Plex2Shell technique is adapted to similar media server software, which would broaden the pool of affected devices.

Sources

PSA: Patch your Plex media server before someone hacks it · Ars Technica - All content

Checked

9 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedHeadline: Researchers warn of active attacks on unpatched Plex media servers.Ars Technica - All content: “Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.”
SupportedSummary: Exploit chain 'Plex2Shell' delivers cryptominers and proxy malware to vulnerable devices.Ars Technica - All content: “A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell." ... So far, successful attacks are installing two payloads.”
SupportedOpening: Attackers are actively exploiting recently fixed Plex vulnerabilities to break into unpatched devices and install malware, according to a security researcher who tracked attacks with a decoy server.Ars Technica - All content: “Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware... The new details allowed a separate researcher to create a honeypot that could track attempts in the wild...”
SupportedPlex released fixes for four vulnerabilities at the start of last month.Ars Technica - All content: “Plex fixed four vulnerabilities at the start of last month.”
SupportedThree weeks later, published CVE designations revealed five vulnerabilities in total, one with severity 8.6 out of 10.Ars Technica - All content: “Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10.”
SupportedLast week, a researcher published details of an exploit chain linking four flaws for remote code execution and named it Plex2Shell.Ars Technica - All content: “A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell."”
SupportedThe publication of those details allowed a separate researcher to set up a honeypot to track attempts in the wild.Ars Technica - All content: “The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain.”
SupportedWithin a day, the honeypot was actively scanned, and eventually attackers succeeded in infecting it.Ars Technica - All content: “Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices.”
SupportedSo far, successful attacks deliver two payloads: a cryptominer that mines to an attacker-controlled wallet, and residential proxy software that routes internet traffic, much of it illegal, through the infected device.Ars Technica - All content: “So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box...”