# Plex Media Server Vulnerability Chain (Plex2Shell) Exploited in the Wild to Deploy XMRig Cryptominer - CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

> Four chained Plex Media Server vulnerabilities (Plex2Shell) allow unauthenticated remote code execution through SSRF, loopback plugin-API injection, owner-token theft and loading of unsigned codec shared objects. A researcher recorded wild exploitation against a honeypot on 2026-10-17, one day after the public PoC release, resulting in XMRig and proxyware deployment. The attackers are not attributed.

- **Published:** 2026-10-19T04:35:41Z
- **Last reviewed:** 2026-10-21T18:46:20.218Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3858
- **ID:** TL-2026-3858
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-96651

## Description

Plex2Shell is a public exploit chain against Plex Media Server versions before 1.43.3.10828 (fixed in 1.43.3.10861 and later; Plex announced Plex Media Server 1.43.3 and Plex Desktop 1.115.0 security updates on 2026-09-01). It chains four CVEs to reach code execution as the Plex service account with no login. The PoC repository (code-zm/plex2shell) claims CVSS 3.1 9.8; no NVD or vendor score was available at research time, so the CVSS vector is left unset.

Stage 1 (CVE-2026-96652): the /player/timeline companion-protocol handler accepts any value in the X-Plex-Token header (it checks for presence, not validity), so an unauthenticated caller can reach it. The protocol parameter used for player callback registration (protocol/host/port) accepts a full URL, so on unsubscribe the server issues a POST to an attacker-chosen loopback destination (SSRF). Stage 2 (CVE-2026-96654): the loopback-only agent API at /system/agents/*/searchOne has a broken @lock authorization guard that discards the validation result when the identifier is invalid, and splices the identifier into an internal URL without encoding. Query-string and fragment injection then forges requests to arbitrary plugin functions. Stage 3 (CVE-2026-96655): the plugin framework automatically attaches the owner's admin token to outbound requests whose URL starts with http://127.0.0.1. The prefix check is unbounded, so a hostname such as 127.0.0.1.<attacker-ip-dashed>.sslip.io resolves to attacker infrastructure and still receives the owner token. The bundled TVDB agent's GetResultFromNetwork function makes the authenticated request. The PoC documentation describes this stage as an owner-authenticated transcoder SSRF combined with an arbitrary-path file write via the x264 dump-yuv option; the news article summarises it as gaining owner-authorized request privileges.

Stage 4-5 (CVE-2026-96656): using the owner token, the attacker sets the TranscoderH264Options preference to dump-yuv=<codec-dir>/x.so:qp=0 and hosts a carrier H.264 MP4 whose frame data encodes an ELF payload. A call to /video/:/transcode/universal makes x264 write decoded frames to the Codecs directory; the next transcode enumerates the codec directory and calls dlopen() on every .so file there. The loader checks no lib prefix, no execute bit, no signature and no symbol, so the ELF constructor runs with Plex service privileges. The PoC requires Python 3.8+, FFmpeg and GCC (or a cross-compiler for Windows targets), and reachability for media fetches and reverse-shell callbacks. Default PoC ports are 8952 (token), 8933 (carrier) and 9001 (reverse shell) and are configurable. The disclosure examples are Linux (uid=1000(plex), /var/lib/plexmediaserver); Windows/macOS impact is not explicitly addressed.

In-the-wild activity: BoredHackerBlog recorded attacks on a honeypot on 2026-10-17. Requests came from 45.194.92.222 (with 91.92.40.202 and 176.65.139.228 also seen exploiting) using the Python-urllib/3.10 user agent against /player/timeline/subscribe, with sslip.io rebinding hostnames of the form 127.0.0.1.45-194-92-222.sslip.io. Payloads were fetched from 217.60.194.116: a dropper named docker, a packed binary x (which unpacks to an XMRig miner) and a proxyware binary myawesomeproxy, whose banner states that running it agrees to external use of the host's internet traffic. Proxy traffic referenced proxystream.st. Attacker ports, domains and filenames are flexible, so detections should key on exploit behavior as well as these indicators. The honeypot packet captures are published in BoredHackerBlog/plex2shell_pcap (from_honeypot directory).

Defenders should upgrade to 1.43.3.10861 or later (the penligent summary names 1.43.3.10896 as the latest build at that time), confirm the running version, review Plex process trees (for example ps axjf) for unexpected children, and watch for unexpected mining or proxy processes, outbound fetches to bare IPs, writes to the Codecs directory and changes to TranscoderH264Options. Exposed Plex servers (TCP 32400) are the target. The BeaconBeagle API returned HTTP 404 for 45.194.92.222 and 217.60.194.116, so no C2 correlation could be recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1129 Shared Modules
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1090 Proxy
- T1496.001 Resource Hijacking: Compute Hijacking
- T1528 Steal Application Access Token
- T1105 Ingress Tool Transfer
- T1027.002 Obfuscated Files or Information: Software Packing
- T1496.002 Resource Hijacking: Bandwidth Hijacking
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware](https://cybersecuritynews.com/plex-vulnerabilities-exploited-in-wild/)
- [Plex vulnerabilities being exploited in the wild (BoredHackerBlog)](https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
- [Plex2Shell exploit repository (code-zm)](https://github.com/code-zm/plex2shell/)
- [Plex2Shell: Unauthenticated RCE analysis (zmain.info)](https://zmain.info/blog/plex2shell)
- [Plex2Shell packet captures (lab and honeypot)](https://github.com/BoredHackerBlog/plex2shell_pcap)
- [Plex2Shell detection content (hunt, tests, yara)](https://github.com/code-zm/plex2shell/tree/main/detection)
- [Plex CVE analysis (Penligent) - Plex 1.43.3 security update](https://www.penligent.ai/hackinglabs/es/plex-cve/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3858