🚨 Plex2Shell vulnerability chain reportedly exploited against outdated Plex servers PoC: github.com/code-zm/plex2shel… A security researcher says an internet-facing Plex honeypot was compromised on October 17 using an exploit chain targeting four recently disclosed vulnerabilities: • CVE-2026-96652 • CVE-2026-96654 • CVE-2026-96655 • CVE-2026-96656 ⠀ The flaws can be chained to achieve unauthenticated remote code execution on affected Plex Media Server installations. ⠀ Observed payloads included an XMRig cryptocurrency miner and a proxy application named “myawesomeproxy,” which could allow attackers to route traffic through compromised residential connections. ⠀ Potential signs of compromise include suspicious child processes launched by Plex Media Server and processes or command lines containing: • myawesomeproxy • mylovelyminer • x12345 • --rig-id • --donate-level • proxystream[.]st ⠀ Plex fixed the vulnerabilities in Media Server 1.43.3.10861. Administrators running earlier versions should update immediately and inspect internet-facing Linux and Docker deployments for suspicious processes. ⠀ The exploitation evidence currently comes from one researcher’s honeypot and has not been independently confirmed as a wider campaign.