--- title: Patched Plex Media Server flaws are being exploited to... description: Four chained vulnerabilities in Plex Media Server (patched last month, affecting v1.43.2 and earlier) are being actively exploited via an exploit chain called... canonical: https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Patched Plex Media Server flaws are being exploited to install cryptominers and proxy software | daily.dev og:description: Four chained vulnerabilities in Plex Media Server (patched last month, affecting v1.43.2 and earlier) are being actively exploited via an exploit chain called... og:url: https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th og:image: https://api.daily.dev/og/posts/XDGIh05Th.png og:image:alt: Patched Plex Media Server flaws are being exploited to install cryptominers and proxy software og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Patched Plex Media Server flaws are being exploited to install cryptominers and proxy software **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Four chained vulnerabilities in Plex Media Server (patched last month, affecting v1.43.2 and earlier) are being actively exploited via an exploit chain called Plex2Shell to gain remote code execution. One CVE scored 8.6/10. A honeypot recorded successful exploitation starting October 17, 2026, with attackers first dropping a Docker-based xmrig cryptominer, then a residential proxy tool called myawesomeproxy that can mask illegal traffic through compromised home connections and potentially pivot toward corporate VPNs and email. Admins are urged to update past v1.43.2 and check for unauthorized Docker containers or proxy software; indicators of compromise and detection signatures have been published. ## Content Attackers are exploiting four chained vulnerabilities in Plex Media Server to get remote code execution on exposed servers. Plex patched the bugs at the start of last month. Servers that haven't updated since then are the targets. ## The vulnerabilities The affected CVEs are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. They affect Plex Media Server v1.43.2 and earlier. One of them scored 8.6 out of 10. A researcher chained them into an exploit called Plex2Shell, which leads to code execution on the server. ## What attackers are doing with it A researcher who goes by BoredHackerBlog set up a honeypot after the disclosure. Scanning showed up within a day. From October 17th, 2026, the honeypot saw exploitation attempts from multiple IP addresses. The successful infections dropped two kinds of malware: - A Docker-based cryptominer (xmrig). - Later, a proxy tool called myawesomeproxy. The proxy software is the more worrying of the two. It lets attackers route illegal traffic through a victim's home server so it looks like ordinary residential traffic. In the worst case, it could also give them a way toward corporate VPNs and email. Users on Reddit have reported the same thing on their own machines. They found suspicious processes named "myawesomeproxy" and "mylovelyminer" running as child processes of Plex. Linux and Docker installs that are reachable from the internet seem to be hit most often. ## What to do Update Plex Media Server now, especially if it's exposed to the internet and hasn't been updated since August. Then check the running processes for the names above. If you find them, treat the machine as compromised. The researcher has published indicators of compromise, file hashes, packet captures, exploit code and detection signatures, and has been updating them as the attacks continue. ## Questions this post answers ### What CVEs are being exploited in Plex Media Server right now? CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 are being chained together in an exploit called Plex2Shell to achieve remote code execution on Plex Media Server v1.43.2 and earlier. One of the four vulnerabilities received a severity score of 8.6 out of 10. Plex patched them at the start of the prior month, but unpatched servers are still being targeted. _Teams tracking active exploit chains against self-hosted media servers follow writeups like this on daily.dev._ ### What malware is being installed on hacked Plex servers? Attackers first deployed a Docker-based cryptominer using xmrig, then shifted to installing a residential proxy tool called myawesomeproxy. The proxy payload routes an attacker's traffic through the victim's home internet connection, obscuring its true origin, and could also serve as a foothold toward reaching corporate VPNs and email accessible from that network. _Admins hunting for compromise indicators on home servers can keep tabs on incidents like this via daily.dev._ ### How do I check if my Plex server was compromised by the Plex2Shell exploit? Update Plex Media Server past version 1.43.2, then inspect the host for an unexpected Docker container running a cryptominer or for proxy software such as myawesomeproxy that was not installed deliberately. A security researcher who ran a honeypot has published indicators of compromise, file hashes, packet captures, and detection signatures, updating them as attacks continue. _daily.dev surfaces follow-up detection guidance for self-hosters patching exposed media servers._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 44 comments across hackernews (as of 2026-10-20). **TL;DR:** Discussion centers less on the vulnerability itself and more on whether exposing Plex (or any self-hosted media server) to the internet is reckless, with many defending the practice as necessary for non-technical friends/family and others recommending Tailscale or VPNs instead. **Sentiment:** 10% positive · 35% mixed · 55% skeptical **The case for** - Several people note Plex's convenience for non-technical friends/family and cross-device support is the whole reason they accept the exposure risk. - Some argue the risk is manageable since access is authenticated and no worse than exposing any other software. - One commenter mitigates risk by running Jellyfin in ephemeral, read-only containers that are destroyed after each use. **The pushback** - Multiple commenters call exposing Plex to the internet terrifying or reckless, especially on NAS devices like Synology that run outdated Docker/package versions. - Several report being personally hit by cryptominers (icloud-services, mylovelyminer) via Plex or OS vulnerabilities, with cleanup being annoying. - Critics argue non-technical friends/family alternatives (Tailscale, VPN) are hard to explain or configure on devices like Android TV/Fire Stick. - Complaints that Plex doesn't force automatic updates, leaving many servers unpatched for months. - Separate gripes that Plex's recent UI overhaul (shared codebase) made the app slow and unusable on non-PC devices, pushing some toward Jellyfin. **By community** - hackernews (heated): A long, contentious thread debating whether exposing Plex/Jellyfin/NAS devices to the internet is reckless or a necessary tradeoff for sharing media with non-technical users, alongside side-threads on Synology reliability, Tailscale as an alternative, personal cryptominer infection stories, and complaints about Plex's slow UI and lack of forced auto-updates. **Hottest debate:** Whether it's reasonable/safe to expose a Plex (or similar) media server directly to the internet versus requiring VPN/Tailscale access. **Open questions** - Is there any solid evidence that Plex is more insecure than comparable self-hosted software, or is that reputation unfounded? - What's the best way to give non-technical friends/family easy access without exposing a server directly to the internet? **Highlights** > > This is terrifying. Who runs things like this open to the outside? A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it). It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it. Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container. When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore. All that I care about are data: like family pictures and movies (and, say, other movies). My Jellyfin server is just a temporary "view" on my actual data. I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed. > — [TacticalCoder on hackernews · 2 comments](https://news.ycombinator.com/item?id=50156120) > I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software". After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying. I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8). > — [xavdid on hackernews · 1 comments](https://news.ycombinator.com/item?id=50156001) > Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer." > — [iamjackg on hackernews](https://news.ycombinator.com/item?id=50157558) > That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance. Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do? I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com). Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs). Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon. FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request). > — [DaSHacka on hackernews · 1 comments](https://news.ycombinator.com/item?id=50156592) > What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk > — [Orygin on hackernews · 1 comments](https://news.ycombinator.com/item?id=50156261) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50152321) · 101 points · 44 comments ## Similar posts on daily.dev - [I got hacked, my server started mining Monero this morning.](https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u) · Hacker News · 2 upvotes · 1 comments - [Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer](https://daily.dev/posts/threat-actors-exploit-critical-ahsaycbs-flaws-to-drop-webshells-and-xmrig-cryptominer-68sjl9tak) · Huntress Blog · 0 upvotes · 0 comments - [From Langflow to Monero: Inside CVE-2026-33017 Cryptominer](https://daily.dev/posts/from-langflow-to-monero-inside-cve-2026-33017-cryptominer-yaxregtae) · Trend Micro · 0 upvotes · 0 comments - [Attackers build “silent” cryptominer on victim’s machine and give themselves away](https://daily.dev/posts/attackers-build-silent-cryptominer-on-victim-s-machine-and-give-themselves-away-ub0cbxgd9) · IT Security Guru · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Patched Plex Media Server flaws are being exploited to install cryptominers and proxy software","url":"https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th"},"datePublished":"2026-10-19T19:44:54.371Z","dateModified":"2026-10-20T04:18:40.633Z","description":"Four chained vulnerabilities in Plex Media Server (patched last month, affecting v1.43.2 and earlier) are being actively exploited via an exploit chain called...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c9dca42ff170f4b7c83ab1365b567968?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c9dca42ff170f4b7c83ab1365b567968?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Patched Plex Media Server flaws are being exploited to install cryptominers and proxy software"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/patched-plex-media-server-flaws-are-being-exploited-to-install-cryptominers-and-proxy-software-xdgih05th#faq","mainEntity":[{"@type":"Question","name":"What CVEs are being exploited in Plex Media Server right now?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 are being chained together in an exploit called Plex2Shell to achieve remote code execution on Plex Media Server v1.43.2 and earlier. One of the four vulnerabilities received a severity score of 8.6 out of 10. Plex patched them at the start of the prior month, but unpatched servers are still being targeted. Teams tracking active exploit chains against self-hosted media servers follow writeups like this on daily.dev."}},{"@type":"Question","name":"What malware is being installed on hacked Plex servers?","acceptedAnswer":{"@type":"Answer","text":"Attackers first deployed a Docker-based cryptominer using xmrig, then shifted to installing a residential proxy tool called myawesomeproxy. The proxy payload routes an attacker's traffic through the victim's home internet connection, obscuring its true origin, and could also serve as a foothold toward reaching corporate VPNs and email accessible from that network. Admins hunting for compromise indicators on home servers can keep tabs on incidents like this via daily.dev."}},{"@type":"Question","name":"How do I check if my Plex server was compromised by the Plex2Shell exploit?","acceptedAnswer":{"@type":"Answer","text":"Update Plex Media Server past version 1.43.2, then inspect the host for an unexpected Docker container running a cryptominer or for proxy software such as myawesomeproxy that was not installed deliberately. A security researcher who ran a honeypot has published indicators of compromise, file hashes, packet captures, and detection signatures, updating them as attacks continue. daily.dev surfaces follow-up detection guidance for self-hosters patching exposed media servers."}}]} ```