All articles tagged with #plex2shell
Hackers are actively exploiting a chain of four vulnerabilities in Plex Media Server, known as Plex2Shell, to install cryptominers and proxy backdoors. Although Plex patched these flaws in August 2026, unpatched servers remain vulnerable to unauthenticated remote code execution. Users are urged to update to version 1.43.3 immediately.
Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, known as Plex2Shell, to install cryptocurrency miners and residential proxy software. The attack chain, which enables unauthenticated remote code execution, was disclosed publicly on October 16, 2026, with exploitation observed within 24 hours. Although Plex patched the flaws in August 2026, unpatched instances remain vulnerable to these payloads, which include an XMRig miner and a stealthy Linux backdoor.