Malicious actors have begun exploiting a chain of security vulnerabilities known as 'Plex2Shell' targeting 'Plex Media Server', just one day after technical details and proof-of-concept exploit code were publicly released on October 16. The chain consists of four vulnerabilities registered under the CVE codes CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which, when combined, allow remote code execution on exposed servers without requiring valid credentials and under the same privileges as the Plex service.
The origins of the issue date back to a report sent to the mentioned company on July 27, where the company acknowledged the vulnerabilities and issued a bug bounty reward on August 4. Later on September 1, Plex announced that it had released the necessary updates and urged server owners to upgrade immediately.
Detection of Live Attacks via a Honeypot Platform
A security researcher was able to monitor actual exploitation operations by setting up an internet-connected honeypot running a vulnerable version. Prior to October 17, the platform received only reconnaissance scans and general attack attempts, before recording real exploitation attacks utilizing the publicly published code.
These attacks resulted in the installation of two malicious programs on the honeypot environment: the first is a cryptocurrency mining tool built on the 'XMRig' system, and the second is a program called 'myawesomeproxy' that operates as a proxy software utilizing the victims' network traffic.
Why This News Matters?
This incident demonstrates the record-breaking speed at which newly disclosed vulnerabilities are transformed into active attacks on the internet, posing a severe threat to unpatched servers. Furthermore, the use of proxy tools indicates the attackers' desire to leverage residential IP addresses associated with Plex servers to access corporate virtual networks and email accounts.
These developments emphasize the necessity of adhering to Plex's previous security recommendations, which stressed the importance of installing the latest software versions as soon as they become available to avoid the risks associated with those critical vulnerabilities.