Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Summary: Threat actors began exploiting a chain of four Plex Media Server vulnerabilities, collectively called Plex2Shell, one day after technical details went public on October 16, 2026, achieving unauthenticated remote code execution on susceptible instances. The attacks use a shell script to fetch a miner payload called "x12345" from 217.60.194[.]116 via wget or curl, and also deliver "myawesomeproxy," a Linux backdoor and reverse proxy, alongside an XMRig miner process named "mylovelyminer" pointing to ota.proxystream[.]st. The flaws were disclosed to Plex by researcher Zach Main on July 27, 2026, and patched in version 1.43.3.10861 released August 3, 2026.
What's compelling: The mining domain shares a parent with global.relay.proxystream[.]st, which Bitsight flagged in August 2026 in connection with the AISURU DDoS and proxyware botnet, so a compromised Plex host may be feeding a botnet rather than just burning CPU. Reddit posts show multiple Plex users hit with the same "mylovelyminer" payload, though it is not yet known whether those cases stem from Plex2Shell.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-96651
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026