Plex2Shell Chain Delivers XMRig and myawesomeproxy Backdoor via Four CVEs
Attackers chained four CVEs in Plex Media Server to achieve unauthenticated RCE and deploy XMRig plus a stealth Linux proxy backdoor hours after public disclosure. The operation reuses infrastructure previously tied to the AISURU botnet and follows the established pattern of rapid cryptominer exploitation of newly public media-server flaws. Organizations must treat exposed Plex instances as high-priority assets in supply-chain risk assessments.
The four-vulnerability chain begins with unauthenticated SSRF on /player/timeline, escalates via searchOne token theft, then uses authenticated SSRF on /video/:/transcode/universal to pull an ELF payload that lands in the Codecs directory for execution. Observed command-and-control IPs 91.92.40[.]202, 176.65.139[.]228, and 45.194.92[.]222 match patterns previously tied to cryptomining campaigns that reuse the same dropper infrastructure across multiple exposed services.
Plex disclosed the issues on 27 July 2026 and shipped fixes in 1.43.3.10861 on 3 August; exploitation only materialized after boredhackerblog published weaponization details on 16 October. This timeline repeats the 2023-2024 pattern where public PoCs for media-server flaws trigger rapid miner deployment before most administrators apply patches.
The concurrent use of myawesomeproxy, previously linked by Bitsight to the AISURU proxyware network on global.relay.proxystream[.]st, indicates the operators are monetizing both compute and bandwidth. Reddit reports of mylovelyminer on Plex hosts suggest the campaign is broader than the single IP set reported.
Exposed Plex instances remain attractive targets because they sit on consumer and small-business networks with minimal segmentation. Continued scanning from the listed IPs is expected until patching reaches critical mass or the infrastructure is rotated.
Shodan: more than 15% of publicly indexed Plex servers remain on versions prior to 1.43.3.10861 by 15 November 2026
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html)
- [2]Supporting Source(https://bitsight.com/blog/aisuru-botnet-proxyware)