Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
Attackers are breaking into old Plex Media Server installs and turning them into cryptocurrency miners and paid traffic relays. The researcher behind boredhackerblog says a Plex honeypot was hit on Oct. 17, one day after a public proof of concept for a four-bug chain nicknamed “Plex2Shell” was published. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on Oct. 20. Plex shipped the fix back in September, so this is a story about servers nobody updated.
For defenders
Affected: Plex Media Server 1.43.2 and earlier. Fixed: 1.43.3.10861 or later, per Plex’s advisory (first posted Sept. 1, updated Oct. 19). Plex says any internet-reachable server older than that should be treated as possibly compromised.
CVEs: CVE-2026-96652 (SSRF via the /player/timeline “protocol” parameter), CVE-2026-96654 (URL injection that lets callers invoke other plugins’ functions), CVE-2026-96655 (SSRF via /video/:/transcode/universal), CVE-2026-96656 (file-path control that lets an admin write files executed on load). CISA’s descriptions say each can be chained with the others. Per-CVE CVSS scores were not disclosed in the sources we read; the researcher’s write-up rates the full chain 9.8 and says it works unauthenticated, because the server only checks that an X-Plex-Token header exists, not that it’s valid.
Status: exploitation KNOWN (boredhackerblog honeypot; CISA KEV, added Oct. 20, federal due dates Oct. 23 and Nov. 3). PoC public since Oct. 16. Captured payloads included an XMRig miner, a UPX-packed binary named “x”, and a proxy tool called “myawesomeproxy” tied to proxystream[.]st traffic. Exploit requests used a Python-urllib/3.10 user agent. Behavior maps to T1190 (Exploit Public-Facing Application) (Exploit Public-Facing Application) and T1496 (Resource Hijacking) (Resource Hijacking). The researcher has published detections, and boredhackerblog shared pcaps for signature testing.
91.92.40[.]202
176.65.139[.]228
45.194.92[.]222
217.60.194[.]116 (payload download)
127.0.0.1.45-194-92-222.sslip[.]io:8952 (callback)
proxystream[.]st5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 (Docker file)
68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 (x, UPX-packed)
b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 (x, unpacked)
e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 (myawesomeproxy)
2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db (xmrig)What it means for you
If you run Plex at home and it’s reachable from the internet, an outdated copy can let a stranger run programs on your computer without a password. In the reported attacks, that meant a miner eating your CPU and electricity, plus a proxy tool that routes other people’s internet traffic through your home connection. Whatever they do online can trace back to your IP address. If you only watch Plex and don’t host a server, there’s nothing to do here.
Do this now
- Update Plex Media Server to 1.43.3.10861 or newer, then confirm the version under Settings → General in Plex Web.
- If the server was exposed while outdated, check for compromise the way Plex suggests: unfamiliar processes, unexpected .so or .dll files in the Codecs folder, connections to proxystream[.]st, and high CPU with nothing playing. If in doubt, rebuild from a clean install, clear the Codecs folder, sign out all devices and change your Plex password.
- Turn off Remote Access if you don’t need it, and stop forwarding port 32400 straight to the internet.
- Defenders: search Plex logs for
/player/timelinerequests whose “protocol” parameter points at 127.0.0.1 or an outside host, and alert on Python-urllib user agents hitting Plex.