TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A security researcher reported that attackers began exploiting Plex Media Server vulnerabilities in the wild by Oct. 17, 2026. Activity against the researcher’s honeypot led to a cryptominer download and, in a later update, proxy software; the scope of attacks and the number of affected servers are unknown.
A security researcher says attackers are exploiting multiple Plex Media Server vulnerabilities to run code remotely, after observing attacks against a vulnerable honeypot on Oct. 17, 2026. The activity downloaded a cryptominer, and a later update from the researcher reported proxy software as well, adding a potential use beyond mining to the threat.
The researcher, writing on BoredHackerBlog, said they set up a honeypot running a vulnerable Plex version after Plex announced security updates on Sept. 1. The researcher initially saw scanning and generic exploit attempts, then observed what they described as in-the-wild exploitation on Oct. 17. The report says several vulnerabilities can be chained to achieve remote code execution; it identifies CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
According to the post, one attack downloaded a file from 217.60.194.116 after the honeypot was configured to allow outbound traffic. The researcher identified the downloaded payloads as a cryptominer. They also listed three IP addresses associated with exploitation in their observations: 45.194.92.222, 91.92.40.202 and 176.65.139.228. These are indicators from a single honeypot report, not a confirmed list of all infrastructure involved.
In an update dated Oct. 17, the researcher said they had seen more activity and found a program called “myawesomeproxy” running alongside an XMRig miner. The post included hashes and links to collected artifacts and sandbox results. The researcher said they had not had time to analyze the proxy program fully, so its purpose and behavior have not been independently established by the report.
From Mining to Proxy Software
The observations show that the Plex vulnerabilities are not only the subject of a published proof of concept: at least one vulnerable honeypot received an attack that led to a malicious file download. Remote code execution can let an attacker run software on a server, potentially consuming its computing resources for mining and creating other risks for the system owner.
The proxy finding broadens the reported activity, but its implications should be treated cautiously. The researcher noted that proxy software could let an operator route traffic through a compromised host; however, the post did not establish who controlled the program, how it was used, or whether it enabled access to other networks. Plex servers exposed from residential connections may be attractive as intermediaries, but that is a concern raised by the researcher, not a confirmed use in this incident.
For Plex users, the report is a reason to check whether their server is running a version covered by Plex’s security update and to apply the vendor’s fixes. The available evidence does not show how many public-facing servers have been attacked or whether any specific victim beyond the honeypot was compromised.
As an affiliate, we earn on qualifying purchases.
Plex Disclosure and Exploit Release
Plex issued a security announcement and emailed users on Sept. 1, 2026, urging important updates for Plex Media Server version 1.43.2 and earlier, according to the researcher. The original announcement initially offered limited technical detail. The researcher said CVE entries appeared on Sept. 26 and later linked to a technical post about a chain of vulnerabilities.
On Oct. 16, the author of the “Plex2Shell” research published details and code, according to the blog post. The researcher said they tested the chain in a lab and shared packet captures for detection work. The original researcher’s post links to the exploit author’s code and detection materials; publication of proof-of-concept material provides security teams with technical references, while also making timely patching more pressing for exposed installations.
The honeypot account is an individual researcher’s observation, not a vendor incident report or a broad measurement of attacks. The author also cautioned that outbound network restrictions and later configuration changes limited what they could capture. Some payloads may be missing, and attackers may have used modified code or techniques.
“As of this morning (Oct 17th), I finally saw in the wild exploitation.”
— BoredHackerBlog researcher
As an affiliate, we earn on qualifying purchases.
Scope and Payload Details Remain Open
The report does not establish the number of compromised Plex servers, the geographic or organizational reach of the attacks, or whether attackers have used the vulnerabilities against systems outside honeypots. Plex has not been quoted in the source material responding to the observed exploitation, and no broader incident count is provided.
The researcher said outbound traffic was initially blocked, then enabled to observe the download, and that this change affected data collection. They had not reviewed all packet captures at the time of writing. The listed IP addresses and file hashes should therefore be read as observations from the honeypot, rather than a complete or definitive set of indicators.
The proxy software’s capabilities, operator and actual use are also unresolved. The researcher linked it to traffic associated with proxystream.st and shared sandbox references, but said they had not analyzed it fully. The available material does not confirm that the software was used to access corporate VPNs, email accounts or other third-party services.
As an affiliate, we earn on qualifying purchases.
Patch Systems and Track New Findings
Administrators should check Plex’s security announcement for affected versions and install the vendor’s available update. Security teams can review the researcher’s published packet captures and the exploit author’s detection materials, while treating the honeypot indicators as leads rather than a complete account of attacker infrastructure.
The researcher said additional artifacts and hashes were posted as activity continued through Oct. 17 and 18, and linked to detection guidance from the exploit author. Further analysis may clarify what the proxy component does and whether other operators are using the same vulnerability chain. The source material does not provide a timeline for further Plex disclosures or a confirmed estimate of affected systems.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are attackers doing with the Plex vulnerabilities?
In the researcher’s honeypot, an attack downloaded a file identified as a cryptominer. A later update reported proxy software alongside an XMRig miner, but its behavior was not fully analyzed in the post.
Which vulnerabilities are named in the report?
The post names CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. It says the vulnerabilities were chained to achieve remote code execution.
Does the report show how many Plex servers were affected?
No. It documents activity against one researcher’s honeypot and does not give a count of compromised public servers or other victims.
What should Plex server operators do?
Check Plex’s security announcement for affected versions and apply the vendor’s available security update. The report does not provide a separate remediation procedure beyond referencing Plex’s update guidance.
Is the proxy software confirmed to be used for other attacks?
No. The researcher reported finding proxy software but said it had not been fully analyzed. The source does not confirm its operator, intended use or whether it was used to reach other networks.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
