Plex Media Server RCE Chain Deploys Cryptominers on Unpatched Systems

Plex Media Server installations running versions prior to the recent patch are currently under active attack. According to Ars Technica, threat actors are exploiting a chain of four vulnerabilities to gain remote code execution. The vendor addressed these flaws at the start of last month, but systems that have not yet been updated remain exposed to this specific threat vector.

In plain English

Attackers are using a method called "Plex2Shell" to break into Plex servers. This exploit chains four separate weaknesses together. It starts with an unauthenticated server-side request forgery. The attacker then pivots through a loopback address to steal a security token. With that token, they deliver and execute malicious code on the device. This process allows complete control over the affected system without needing valid user credentials.

The background

Published CVE designations revealed five vulnerabilities in total, with one rated 8.6 out of 10 for severity. The exploit chain was originally part of a proof-of-concept submitted by a researcher to Plex. That researcher stated they used artificial intelligence heavily to develop the chain, though they emphasized it required significant manual judgment and iterative work. A separate researcher created a honeypot to track wild exploitation, observing active scanning and successful infections within a day of setup.

What changes now

Successful exploitation results in the installation of two types of malware. One payload is a cryptominer that uses the device's resources to mine cryptocurrency for the attacker. The other is residential proxy software. This software allows criminals to anonymize their internet activity by routing traffic through the infected Plex server. Attackers reportedly seek these residential IP addresses to access corporate VPNs and email accounts while hiding their true location.

Who needs to act first

Teams should prioritize updating any Plex Media Server instances exposed to the internet or connected to sensitive networks. Verify which systems are running vulnerable versions before applying patches. Test the update in a non-production environment to ensure it does not disrupt media services. Back up configuration files and data before proceeding. If immediate patching is not possible, restrict network access to the server and monitor for unusual outbound traffic that might indicate proxy or mining activity.

What to do and how to stay safe: Plex Media Server

• Identify all Plex Media Server installations in your environment and verify their current version status against the patched release.
• Apply the vendor's update immediately to any system confirmed to be running a vulnerable version, prioritizing those with external network exposure.
• Monitor server logs and network traffic for signs of unauthorized access, such as unexpected outbound connections or high CPU usage indicative of mining.
• Review firewall rules to ensure Plex services are not unnecessarily exposed to public networks, limiting access to trusted internal IPs where possible.

Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits

General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch available for these vulnerabilities?

Yes, Plex fixed four vulnerabilities at the start of last month, according to the source material.

What kind of malware is being installed by these attacks?

Successful attacks install cryptominers and residential proxy software on the affected devices.

How severe are the vulnerabilities involved in this chain?

One of the five published vulnerabilities carries a severity rating of 8.6 out of 10.