Plex vulnerabilities being exploited in the wild to drop a cryptominer

This reports that a chain of Plex Media Server vulnerabilities (CVE-2026-96652, -96654, -96655, -96656) was turned into a working remote‑code‑execution tool dubbed "plex2shell," and that exploitation in the wild has been observed delivering a cryptominer and proxy components. A researcher deployed a vulnerable Plex honeypot, followed public disclosures and a released exploit repository, and documented active scanning and successful exploitation attempts that fetched payloads into the compromised environment. While the payloads seen were primarily cryptominers, operators also deployed a proxy component that exposes residential IPs for potential misuse of corporate VPNs or other services.

The timeline and technical indicators are specific: Plex issued a security notice Sept 1, CVE entries appeared Sept 26, the exploit writeup and code were published Oct 16, and in‑the‑wild activity was logged Oct 17. Observed attacker IPs include 45.194.92.222, 91.92.40.202 and 176.65.139.228; the malware download source was 217.60.194.116. Provided IOCs include multiple file hashes (examples: 5712ef51..., 68938fb4..., b20f39fc...), an xmrig binary hash, and artifacts named "myawesomeproxy." Packet captures, the plex2shell code, and detection signatures are available on GitHub for defenders to use.