Plex Media Server 1.43.2 and earlier hit by chained RCE chain CVE-2026-96652 to CVE-2026-96656 for cryptominer drops

The BoredHackerBlog honeypot captured exploitation attempts against an unpatched Plex instance after the 1 September 2026 security advisory. Zeek logs showed crafted URIs targeting /player/timeline/subscribe that triggered the chained vulnerabilities, resulting in outbound connections and docker image pulls. Three source IPs—45.194.92.222, 91.92.40.202, and 176.65.139.228—were observed within 24 hours.

File analysis of retrieved artifacts confirmed a cryptominer payload. The unpacked binary matched known XMRig patterns. Residential IP exposure increases the value of these hosts for subsequent proxy or VPN pivots, a pattern previously documented in 2024-2025 campaigns against other media servers.

Plex forums and CVE detail pages list four CVEs without public CVSS scores above 9.0 at disclosure. The 16 October technical write-up at zmain.info supplied the exploit chain and GitHub repository, enabling rapid weaponization. Honeypot data shows scanning preceded full exploitation by 16 days.

Operational impact centers on unpatched residential deployments. Network defenders should deploy the provided PCAP signatures and block the listed IOCs immediately. Continued monitoring is required as threat actors adapt the same chain for residential proxies.