Plex Media Server vulnerability exploited for crypto-mining

Cybercriminals are actively exploiting a chain of four vulnerabilities, dubbed ‘Plex2Shell’, in the Plex Media Server to gain unauthorized remote code execution. The exploit allows attackers to take full control of exposed servers without requiring any login credentials or valid authentication.

Security researchers, including BoredHackerBlog, have observed the exploit being used in real-time to install malicious software. The primary payloads identified include XMRig, a Monero cryptocurrency miner that consumes significant CPU resources, and ‘myawesomeproxy’, which turns the compromised server into a residential proxy to relay third-party internet traffic.

Impacted users may notice increased CPU load, higher electricity consumption, and hardware overheating. While Plex released security patches in September 2026, many installations—particularly on NAS systems and older devices—remain unpatched and vulnerable. For those already compromised, experts recommend a clean reinstallation of the server, disconnecting associated devices, and changing all passwords.