Plex2Shell turns home Plex servers into proxy and mining nodes

The Plex2Shell campaign exploits four flaws in Plex Media Server before 1.43.3.10861, including CVE-2026-96656 rated 8.6. After compromise, attackers deploy a cryptocurrency miner and a proxy component that resells the host's residential bandwidth. CISA added the CVEs to its KEV catalog on October 20, 2026.

• Chain of four CVEs, including CVE-2026-96656 rated 8.6
• Payloads include a crypto miner and a resale proxy
• ZoomEye found 508,009 internet-facing Plex Media Server assets
• CISA added the flaws to KEV on October 20, 2026