# Plex Media Server Plex2Shell vulnerability exploitation > Live situation record from CLSTR: https://clstr.news/situations/plex-media-server-plex2shell-vulnerability-exploitation > Updated: 2026-10-22T09:58:42.000Z. Sources: 9. Developments: 2. Cybercriminals are actively exploiting a chain of four vulnerabilities, referred to as ‘Plex2Shell’, to achieve unauthorized remote code execution on Plex Media Servers. This exploit allows attackers to take full control of exposed servers without requiring login credentials or valid authentication. Researchers have identified that the attack utilizes a combination of security flaws involving SSRF and security token hijacking. Once a server is compromised, attackers typically install malicious software such as the XMRig Monero cryptocurrency miner or ‘myawesomeproxy’, which converts the hardware into a residential proxy to relay third-party internet traffic. Although security patches were released in September 2026, a significant number of installations—particularly on older devices and NAS systems—remain unpatched and vulnerable. This has resulted in a gap between the availability of fixes and the actual resolution of the security threat. ## Timeline ### 2026-10-22: Plex Media Server vulnerability exploited by cybercriminals Cybercriminals are actively exploiting the ‘Plex2Shell’ vulnerability to hijack unpatched Plex Media Servers for cryptocurrency mining and proxy services. 2 sources. https://clstr.news/cluster/plex-media-server-vulnerability-exploited-by-cybercriminals ### 2026-10-19: Plex Media Server vulnerability exploited for crypto-mining Attackers are exploiting the ‘Plex2Shell’ vulnerability chain to hijack Plex Media Servers for Monero mining and proxy services without requiring authentication. 7 sources. https://clstr.news/cluster/plex-media-server-vulnerabilities-exploited-for-crypto-mining --- Cite as: Plex Media Server Plex2Shell vulnerability exploitation. CLSTR, https://clstr.news/situations/plex-media-server-plex2shell-vulnerability-exploitation