Recent vulnerabilities in the Plex Media Server are currently being exploited by attackers to install malware. A researcher has identified an exploit chain dubbed 'Plex2Shell' that allows remote code execution. Following this discovery, monitoring efforts showed that attackers are actively scanning for and successfully infecting vulnerable devices, deploying cryptominers and residential proxy applications.
Key facts
- Plex fixed four vulnerabilities in September 2026.
- One vulnerability has a severity rating of 8.6 out of 10.
- The exploit chain is named 'Plex2Shell.'
- Successful attacks are installing cryptominers and residential proxy software.
- Active scanning of vulnerable devices was detected within a day of monitoring.
A short AI summary in our own words. The reporting belongs to Ars Technica; we don't reproduce it.