Threat reportVulnerabilityTL-2026-3858
Plex Media Server Vulnerability Chain (Plex2Shell) Exploited in the Wild to Deploy XMRig Cryptominer - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
Plex Media Server Vulnerability Chain (Plex2Shell) Exploited (TL-2026-3858), also tracked as Plex2Shell, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-19 and last reviewed 2026-10-21. It has no confirmed attribution, affects Plex Plex Media Server, references 5 CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655), maps to 13 MITRE ATT&CK techniques (T1027, T1027.002, T1059.004), and is covered by 9 detection rules and 31 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-3858
- Threat ID
- TL-2026-3858
- Also known as
- Plex2Shell
- Severity
- CRITICAL
- CVSS
- 9.8
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, home-users, media-and-entertainment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 31
- Updates
- 2026-10-21 · 5 updates · revalidated 5× · latest source
Malware and tooling in Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
Malware and tooling: xmrig, plex2shell
How Plex Media Server Vulnerability Chain (Plex2Shell) Exploited works
Four chained Plex Media Server vulnerabilities (Plex2Shell) allow unauthenticated remote code execution through SSRF, loopback plugin-API injection, owner-token theft and loading of unsigned codec shared objects. A researcher recorded wild exploitation against a honeypot on 2026-10-17, one day after the public PoC release, resulting in XMRig and proxyware deployment. The attackers are not attributed.
Plex2Shell is a public exploit chain against Plex Media Server versions before 1.43.3.10828 (fixed in 1.43.3.10861 and later; Plex announced Plex Media Server 1.43.3 and Plex Desktop 1.115.0 security updates on 2026-09-01). It chains four CVEs to reach code execution as the Plex service account with no login. The PoC repository (code-zm/plex2shell) claims CVSS 3.1 9.8; no NVD or vendor score was available at research time, so the CVSS vector is left unset.
Stage 1 (CVE-2026-96652): the /player/timeline companion-protocol handler accepts any value in the X-Plex-Token header (it checks for presence, not validity), so an unauthenticated caller can reach it. The protocol parameter used for player callback registration (protocol/host/port) accepts a full URL, so on unsubscribe the server issues a POST to an attacker-chosen loopback destination (SSRF). Stage 2 (CVE-2026-96654): the loopback-only agent API at /system/agents/*/searchOne has a broken @lock authorization guard that discards the validation result when the identifier is invalid, and splices the identifier into an internal URL without encoding. Query-string and fragment injection then forges requests to arbitrary plugin functions. Stage 3 (CVE-2026-96655): the plugin framework automatically attaches the owner's admin token to outbound requests whose URL starts with http://127.0.0.1. The prefix check is unbounded, so a hostname such as 127.0.0.1.<attacker-ip-dashed>.sslip.io resolves to attacker infrastructure and still receives the owner token. The bundled TVDB agent's GetResultFromNetwork function makes the authenticated request. The PoC documentation describes this stage as an owner-authenticated transcoder SSRF combined with an arbitrary-path file write via the x264 dump-yuv option; the news article summarises it as gaining owner-authorized request privileges.
Stage 4-5 (CVE-2026-96656): using the owner token, the attacker sets the TranscoderH264Options preference to dump-yuv=<codec-dir>/x.so:qp=0 and hosts a carrier H.264 MP4 whose frame data encodes an ELF payload. A call to /video/:/transcode/universal makes x264 write decoded frames to the Codecs directory; the next transcode enumerates the codec directory and calls dlopen() on every .so file there. The loader checks no lib prefix, no execute bit, no signature and no symbol, so the ELF constructor runs with Plex service privileges. The PoC requires Python 3.8+, FFmpeg and GCC (or a cross-compiler for Windows targets), and reachability for media fetches and reverse-shell callbacks. Default PoC ports are 8952 (token), 8933 (carrier) and 9001 (reverse shell) and are configurable. The disclosure examples are Linux (uid=1000(plex), /var/lib/plexmediaserver); Windows/macOS impact is not explicitly addressed.
In-the-wild activity: BoredHackerBlog recorded attacks on a honeypot on 2026-10-17. Requests came from 45.194.92.222 (with 91.92.40.202 and 176.65.139.228 also seen exploiting) using the Python-urllib/3.10 user agent against /player/timeline/subscribe, with sslip.io rebinding hostnames of the form 127.0.0.1.45-194-92-222.sslip.io. Payloads were fetched from 217.60.194.116: a dropper named docker, a packed binary x (which unpacks to an XMRig miner) and a proxyware binary myawesomeproxy, whose banner states that running it agrees to external use of the host's internet traffic. Proxy traffic referenced proxystream.st. Attacker ports, domains and filenames are flexible, so detections should key on exploit behavior as well as these indicators. The honeypot packet captures are published in BoredHackerBlog/plex2shell_pcap (from_honeypot directory).
Defenders should upgrade to 1.43.3.10861 or later (the penligent summary names 1.43.3.10896 as the latest build at that time), confirm the running version, review Plex process trees (for example ps axjf) for unexpected children, and watch for unexpected mining or proxy processes, outbound fetches to bare IPs, writes to the Codecs directory and changes to TranscoderH264Options. Exposed Plex servers (TCP 32400) are the target. The BeaconBeagle API returned HTTP 404 for 45.194.92.222 and 217.60.194.116, so no C2 correlation could be recorded.
MITRE ATT&CK techniques used in TL-2026-3858
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1574 Hijack Execution Flow
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1129 Shared Modules
Command and Control
T1090 Proxy; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1528 Steal Application Access Token
Impact
T1496.001 Resource Hijacking: Compute Hijacking; T1496.002 Resource Hijacking: Bandwidth Hijacking
Resource Development
Affected products and versions in Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
- Plex — Plex Media Server
Vulnerable versions: < 1.43.3.10828
Fixed in: 1.43.3.10861 and later - Plex — Plex Desktop
Vulnerable versions: < 1.115.0
Fixed in: 1.115.0
Remediation for Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
Patches
- Plex Media Server 1.43.3.10861 or later; Plex Desktop 1.115.0
Immediate actions
- Upgrade Plex Media Server to 1.43.3.10861 or later (verify the running version)
- Remove Plex TCP 32400 from direct internet exposure until patched
- Review Plex process trees (ps axjf) for unexpected child processes such as xmrig, x, docker or myawesomeproxy
- Block egress to and from 45.194.92.222, 91.92.40.202, 176.65.139.228 and 217.60.194.116
- Inspect the Plex Codecs directory for unexpected .so files and review the TranscoderH264Options preference
Workarounds
- Restrict access to Plex to a VPN or trusted networks
- Block outbound connections from the Plex host to arbitrary internet addresses
Longer-term hardening
- Run Plex as an unprivileged service account in a container or sandbox with restricted egress
- Alert on web requests to /player/timeline carrying invalid X-Plex-Token values or external requests to /system/agents/*
- Alert on resolution of 127.0.0.1.*.sslip.io style hostnames
- Deploy host monitoring for cryptominer and proxyware behavior on media servers
CVEs associated with Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-96651
Weaknesses (CWE) in Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
CWE-918, CWE-287, CWE-74, CWE-829, CWE-84, CWE-73, CWE-862, CWE-200, CWE-427, CWE-22
Timeline of Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
- Vulnerabilities reported to Plex through its security program
- Plex forum announcement dated 2026-08-03 for Plex Media Server 1.43.3.10861, the build containing the fixes (The Hacker News dates the fix to this build; the existing record cites 2026-09-01 for the 1.43.3 release).
- Plex acknowledged the report and paid a bounty
- Bitsight published AISURU research naming global.relay.proxystream.st as a proxyware fallback C2 domain; the same parent domain appears in this campaign.
- Plex released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 with security fixes; CVE IDs were still pending
- CVE-2026-96652, -96654, -96655 and -96656 assigned (a second source dates CVE publication to 2026-09-26)
- Full technical write-up and Plex2Shell PoC published publicly
- BoredHackerBlog honeypot recorded exploitation from 45.194.92.222 deploying XMRig and myawesomeproxy
- Community discussion of the observed exploitation began and honeypot pcaps were shared
- Cyber Security News reported active exploitation of the Plex vulnerabilities
- CISA added the four Plex Media Server CVEs (CVE-2026-96652, -96654, -96655, -96656) to the Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation, and referenced BOD 26-04 for FCEB agencies.
- Press coverage of the CISA KEV addition (BleepingComputer, The Hacker News, Security Affairs) reports that about 49,000 Plex Media Server instances remain unpatched.
- CISA KEV federal remediation deadline for the four Plex2Shell CVEs (CVE-2026-96652, -96654, -96655, -96656).
Update history for TL-2026-3858
- 2026-10-21 — Plex2Shell: Chained Plex Media Server Flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) Exploited In The Wild to Achieve Unauthenticated RCE, Added to CISA KEV: What changed No field escalation. Severity is still CRITICAL, exploitability ACTIVE, status ACTIVE, and the CVSS score 9.8. The report gives the full vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which the existing record left unset.
- 2026-10-20 — CISA Adds Six Vulnerabilities to KEV Catalog: Plex Media Server (CVE-2026-96652/96654/96655/96656), EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931), Siemens Software Center (CVE-2026-110936): What changed No severity, exploitability or status change: the record is already CRITICAL / ACTIVE. CISA KEV listing on 2026-10-20 adds authoritative government confirmation of exploitation. New CVEs (0) None. CVE-2026-106931 (SiteGuard) an
- 2026-10-19 — Plex2Shell exploit chain in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-96651) exploited to deploy XMRig miner and Linux proxy backdoor: What changed No field escalation. The newer report scores the chain lower (HIGH, 8.6, highest single-CVE score) than the existing CRITICAL/9.8, so severity and CVSS are left unchanged (no downgrades). New indicators (3) ota.proxystream.st (
- 2026-10-19 — Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) used to turn vulnerable Plex Media Servers into crypto miners: What changed No severity, exploitability, status or score change; existing values (CRITICAL / ACTIVE / CVSS 9.8) already match the newer report. New indicators (2) 2 new file-based indicators: x.so (planted unsigned codec) and the default L
- 2026-10-19 — Plex2Shell exploit chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) weaponized against Plex Media Server: What changed No field escalation. Severity CRITICAL, exploitability ACTIVE and status ACTIVE already match the newer report; the 9.8 score remains the PoC repository's figure with no published vector. New indicators (6) 6 enrichment indicat
Sources cited for Plex Media Server Vulnerability Chain (Plex2Shell) Exploited
- Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware
- Plex vulnerabilities being exploited in the wild (BoredHackerBlog)
- Plex2Shell exploit repository (code-zm)
- Plex2Shell: Unauthenticated RCE analysis (zmain.info)
- Plex2Shell packet captures (lab and honeypot)
- Plex2Shell detection content (hunt, tests, yara)
- Plex CVE analysis (Penligent) - Plex 1.43.3 security update
Detection coverage for TL-2026-3858
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3858 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.