Why Unpatched Plex Servers Are Being Turned Into Crypto Miners
Plex Media Server is the software plenty of people run on a spare computer or NAS so they can stream films, music and recordings to their TVs and phones. It is built to be reachable from outside the home. That reach is the point — and it is also what turns a stale install into an attractive target. A chain of four vulnerabilities, nicknamed Plex2Shell, lets an attacker run code on an exposed server without ever logging in.
What the exploit chain actually does
SecurityWeek reports the flaws are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. None is enough on its own. Strung together, they are.
Ars Technica walks through the sequence: an unauthenticated server-side request forgery, a pivot through the loopback interface, theft of a security token, delivery of a payload, then execution. No username, no password, no user interaction. The SSRF step makes the server send a request to something it should not reach — itself, or an internal service that trusts local traffic — and the stolen token turns that foothold into something that looks legitimate to the rest of the software.
From break-in to payday
Threat actors were on it fast. According to SecurityWeek, attacks began one day after technical details and a working exploit went public. The payloads seen on a researcher's honeypot were financial rather than destructive: a cryptocurrency miner built on XMRig, followed later the same day by a second program called myawesomeproxy, which fits the profile of proxyware — software that quietly resells a machine's bandwidth.
A media server is a good host for that kind of work. It sits at home, often runs for months without a reboot, and its owner rarely inspects a process tree.
What to check on your own server
Plex fixed the flaws and asked server owners to upgrade. Ars Technica names version 1.43.3 as the release to be running; updates can be set to install automatically, or fetched manually from Plex. The same report suggests limiting access to the local network where remote streaming is not needed, and using strong passwords.
XDA Developers, focusing on Linux and Docker installs, suggests starting with a look at running processes. A Plex Media Server process with an odd child process is the thing to watch for. Specific names to search for include:
myawesomeproxyandmylovelyminerx12345wgetorcurlpulling a script from a bare IP address- command lines containing
--rig-id,--donate-levelor the domainproxystream[.]st
One caveat matters here. The researcher who published those indicators warned that they cover only activity observed on the honeypot. Finding none of them is reassuring, not conclusive. Nothing in the public reporting puts a number on how many servers have been hit.
Why exposure matters more than the bug
Home servers occupy an awkward spot. They are internet-facing by design, patched on the owner's schedule, and rarely watched by anyone with a security team behind them. That is what made this chain worth weaponising so quickly.
The fix is unglamorous: update, cut off outside access you don't use, and look at what is actually running.