Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes
In October 2026, threat actors began actively exploiting a chained set of four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution. The attack chain, involving CVEs 2026-96652, 96654, 96655, and 96656, was weaponized within 24 hours of a public proof-of-concept release on October 16, 2026. Attackers deployed the XMRig-based cryptominer 'mylovelyminer' and a stealthy Linux reverse proxy backdoor named 'myawesomeproxy,' both linked to the AISURU proxyware botnet infrastructure. Plex had patched the flaws in version 1.43.3.10861 released August 3, 2026, but unpatched internet-exposed instances remained vulnerable. This incident underscores the persistent danger of n-day exploitation windows—where attackers race to compromise unpatched systems immediately after PoC publication. The connection to the AISURU botnet signals organized, infrastructure-backed campaigns targeting self-hosted media platforms to harvest compute resources and build covert proxy networks for downstream attacks.
Kill Chain
