Plex2Shell exploit chain weaponized a day after PoC release

A day after technical details and PoC code for the Plex2Shell chain of four Plex Media Server flaws (CVE-2026-96652, -96654, -96655, -96656) went public, a researcher observed in-the-wild attacks on a honeypot. Attackers dropped an XMRig-based cryptominer and a proxy tool called myawesomeproxy. Plex shipped fixes in September.

• Four-CVE chain enables unauthenticated remote code execution with Plex service privileges
• Plex confirmed the flaws on August 4 and released fixes by September 1
• In-the-wild exploitation spotted on October 17 via a vulnerable honeypot
• Attackers deployed an XMRig cryptominer and the myawesomeproxy tool