[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 9 sources · 3 days · First seen · Last updated

Plex Media Server Plex2Shell vulnerability exploitation

Overview

Cybercriminals are actively exploiting a chain of four vulnerabilities, referred to as ‘Plex2Shell’, to achieve unauthorized remote code execution on Plex Media Servers. This exploit allows attackers to take full control of exposed servers without requiring login credentials or valid authentication.

Researchers have identified that the attack utilizes a combination of security flaws involving SSRF and security token hijacking. Once a server is compromised, attackers typically install malicious software such as the XMRig Monero cryptocurrency miner or ‘myawesomeproxy’, which converts the hardware into a residential proxy to relay third-party internet traffic.

Although security patches were released in September 2026, a significant number of installations—particularly on older devices and NAS systems—remain unpatched and vulnerable. This has resulted in a gap between the availability of fixes and the actual resolution of the security threat.

Entities

zmain · Plex Media Server · BoredHackerBlog · Plex · BoredHackerBlog

Timeline

  1. [TECHNOLOGY] 2 sources
    Plex Media Server vulnerability exploited by cybercriminals

    Cybercriminals are actively exploiting the ‘Plex2Shell’ vulnerability to hijack unpatched Plex Media Servers for cryptocurrency mining and proxy services.

  2. [TECHNOLOGY] 7 sources
    Plex Media Server vulnerability exploited for crypto-mining

    Attackers are exploiting the ‘Plex2Shell’ vulnerability chain to hijack Plex Media Servers for Monero mining and proxy services without requiring authentication.

Sources

4kfilme.de · clubic.com · generation-nt.com · gry-online.pl · it-boltwise.de · phonandroid.com · sapo.pt · spacemoney.com.br · spidersweb.pl