Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Security researchers report that attackers are actively abusing a set of four chained Plex Media Server vulnerabilities, dubbed Plex2Shell, just one day after proof-of-concept exploit code was made public. The flaws—CVE-2026-96652 (SSRF via the player timeline endpoint), CVE-2026-96654 (admin token theft through the searchOne endpoint), CVE-2026-96655 (SSRF via the transcode universal path), and CVE-2026-96656 (path control allowing execution of a planted shared object in the Codecs folder)—can be combined to achieve unauthenticated remote code execution. Alongside a related issue, CVE-2026-96651, these bugs were reported to Plex by researcher Zach Main in late July 2026 and fixed in Plex Media Server version 1.43.3.10861 released August 3, 2026. Since public disclosure on October 16, 2026, attackers have been using the chain to install an XMRig cryptominer nicknamed "mylovelyminer" and a stealthy Linux reverse-proxy backdoor called "myawesomeproxy," with one of its infrastructure domains previously linked to the AISURU proxyware botnet; Plex administrators running outdated servers are urged to upgrade immediately.