Plex Media Server vulnerability exploited by cybercriminals

Security researchers have confirmed the active exploitation of a vulnerability chain known as ‘Plex2Shell’. The attack targets unpatched Plex Media Servers exposed to the internet, allowing attackers to achieve remote code execution without requiring an account or login.

The exploit utilizes a combination of four security flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656) involving SSRF and security token hijacking. Once a device is compromised, cybercriminals install cryptocurrency miners and use the victim's hardware as a proxy server for malicious network traffic.

While the manufacturer has released patches, many users remain vulnerable because they have not installed the necessary updates. This highlights a significant gap between the availability of a fix and the actual resolution of the security threat.