Threat Intelligence

Plex2Shell Attacks Hit Media Servers With Crypto Miners and a Hidden Linux Backdoor

The Hacker News · 20 Oct 2026

Key Takeaway If your business runs Plex Media Server anywhere on its network, update it to version 1.43.3.10861 or later immediately and check for unexpected processes or unusual network traffic.

Threat actors have started exploiting a group of vulnerabilities in Plex Media Server, known collectively as Plex2Shell, to install cryptocurrency miners and reverse proxy software. Exploitation attempts were recorded a day after technical details and a proof-of-concept became public on October 16, 2026. According to researcher boredhackerblog, four flaws can be chained together to allow unauthenticated remote code execution, meaning an attacker needs no login to run code on a vulnerable server.

The flaws were reported to Plex on July 27, 2026 by researcher Zach Main, and fixed in Plex Media Server 1.43.3.10861, released on August 3, 2026. Observed attacks delivered a miner payload from a remote server. They also dropped a file called "myawesomeproxy", which VirusTotal describes as a stealthy Linux backdoor and reverse proxy. It displays a message saying that running it means agreeing to external use of your internet traffic. An XMRig miner named "mylovelyminer" was deployed alongside it. A related subdomain of its mining server domain was flagged by Bitsight in August 2026 in connection with the AISURU DDoS and proxyware botnet.

Reddit posts suggest several Plex users have had their servers compromised with the same miner payload, though it is not yet known whether Plex2Shell was the cause. Plex had already urged users to update more than a month earlier, after releasing a fix for multiple unspecified security flaws.

Plex Vulnerability Cryptomining Backdoor Patch Management

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.