Plex2Shell flaw in outdated Plex servers used for crypto mining

Attackers are exploiting a chain of four bugs dubbed Plex2Shell in Plex Media Server versions older than 1.43.3.10861, stealing the owner's admin token without a password. Infected servers run the mylovelyminer crypto miner and myawesomeproxy to route strangers' traffic. Plex urges users to update, sign out everywhere and change passwords.

• Plex Media Server versions older than 1.43.3.10861 are vulnerable
• The four-bug chain hands attackers the owner's admin token
• A planted file executes when Plex converts video for playback
• Plex advises updating, signing out on all devices and changing passwords