Attackers have begun exploiting a series of vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy backdoors. The exploitation chain, known as Plex2Shell, combines four different security flaws that allow unauthorized remote code execution on vulnerable systems. The vulnerabilities were disclosed to Plex in July 2026 and patched in version 1.43.3.10861 released in August. Active attacks began shortly after technical details became public on October 16, 2026.
The malicious payloads deployed include a Linux backdoor and reverse proxy tool called “myawesomeproxy” and an XMRig cryptocurrency miner labeled “mylovelyminer.” The miner connects to servers associated with a domain previously linked to the AISURU DDoS botnet. Multiple Plex users have reported compromised instances on social media. Plex Media Server users are urged to update to the latest version to protect against these active attacks.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
