Attackers moved on Plex Media Server almost as soon as the public exploit appeared. One day after technical details and working code for Plex2Shell were released, a researcher saw real-world exploitation on an internet-facing honeypot running a vulnerable Plex release.
The activity mattered because the flaws can be chained to run arbitrary code on an exposed server without valid credentials, and the code runs with the same privileges as the Plex service. The researcher, Eduard Kovacs, said the attackers used the publicly released exploit and described the payloads as cryptocurrency miner and proxy software.
Plex2Shell is a chain of four Plex Media Server vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The issues were reported to Plex on July 27, confirmed on August 4 with a bug bounty, and later the company said on September 1 that it had already shipped fixes and asked server owners to upgrade. By October 16, the researcher had put out a write-up and proof-of-concept code, and by October 17 the honeypot was showing exploitation.
The first sign was a miner built on XMRig. Later on October 17, a second program called myawesomeproxy appeared, and Kovacs identified it as proxy software. He noted that the program carries a notice saying anyone who runs it agrees to the possible use of their internet traffic, a sign that the goal is not just to burn compute but to route traffic through someone else’s machine.
That is the part that makes this more than a routine proof-of-concept. Plex had already urged every server owner to install the newest release without delay, yet exploitation still started after the exploit details became public. Kovacs also warned that Plex may be hosted on residential IP and that threat actors would love to have residential IP proxy to access corporate VPNs and emails, which is exactly the kind of abuse proxy malware can enable.
The open question is not whether the chain works. It does. The open question is how many real Plex servers were hit after the public release, because the researcher said the indicators of compromise cover only activity seen on the honeypot. For owners of exposed Plex Media Server installations, the message is blunt: patch now, because the window between disclosure and attack was measured in hours, not weeks.
