"Running this software on any of your devices makes you agree to the potential external use of your internet traffic," warned the researcher known as boredhackerblog after discovering a stealthy Linux reverse proxy deployed through newly exploited Plex Media Server flaws.
Plex2Shell: the four-vulnerability chain and what it permits
Security researcher Zach Main disclosed a cluster of related flaws in Plex Media Server to Plex on July 27, 2026; the set — dubbed Plex2Shell by researchers — can be chained to produce unauthenticated remote code execution. The four vulnerabilities, and their CVSS scores as reported, are:
- CVE-2026-96652 (CVSS 5.3) — an unauthenticated server-side request forgery (SSRF) via the "/player/timeline" endpoint, where an unvalidated "protocol" parameter is inserted into a constructed player URL and can force the Plex server to POST to an attacker-chosen destination.
- CVE-2026-96654 (CVSS 6.9) — improper neutralization of URL values in the "searchOne" endpoint that can allow an attacker to invoke other plugins' functions and supply parameters to obtain the owner's admin token.
- CVE-2026-96655 (CVSS 5.3) — an SSRF that lets an authenticated user (i.e., holding the owner token) request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter, enabling retrieval of an attacker-hosted carrier video containing a malicious ELF payload.
- CVE-2026-96656 (CVSS 8.6) — an external control of file name or path vulnerability that allows writing an ELF shared object to an attacker-chosen path in the Codecs directory and executing it.
When combined in the order described above, the vulnerabilities permit an unauthenticated attacker to escalate from SSRF and token theft to dropping and executing an arbitrary ELF payload on vulnerable Plex instances.
Observed exploitation: miners and a reverse proxy backdoor
Technical details of the Plex2Shell chain were published on October 16, 2026; in-the-wild exploitation attempts were recorded a day later. The observed attacks deployed both a cryptocurrency miner and a reverse proxy backdoor.
Researchers reported deployment of an XMRig miner process identified as "mylovelyminer" with its configured mining server pointing to ota.proxystream[.]st. Concurrently, an artifact labeled "myawesomeproxy" — described by VirusTotal as a stealthy Linux backdoor and reverse proxy — was also delivered. Running that program produces the message quoted above by boredhackerblog.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIndicators: IPs, domains, and prior flags
Attack efforts were observed originating from several IP addresses and connecting to a remote server that delivered the miner payload. The report lists the miner's delivery server as 217.60.194[.]116 and notes observed activity from 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222. The mining domain ota.proxystream[.]st is associated with the "mylovelyminer" process.
Bitsight had previously flagged another subdomain of the same domain family — global.relay.proxystream[.]st — in August 2026 in connection with the AISURU DDoS and proxyware botnet. That prior flag places the proxystream[.]st namespace in existing threat telemetry, according to the reporting.
Plex disclosure, patching, and open questions
According to the published timeline, Zach Main disclosed these vulnerabilities (along with CVE-2026-96651, CVSS 7.1) to Plex on July 27, 2026. Plex issued a patch in Plex Media Server 1.43.3.10861 on August 3, 2026. The Hacker News account says Plex was contacted for comment about the recent exploitation and that the outlet would update the story if Plex responded.
The reporting also notes that the current development follows more than a month in which Plex urged users to update their instances after a release that addressed multiple unspecified security flaws; it is unclear from the available material whether the Plex2Shell vulnerabilities were part of that earlier alert. Posts on Reddit indicate multiple Plex users have reported instances compromised with the same "mylovelyminer" payload, but the linkage to Plex2Shell exploitation remains unconfirmed.
What this means for Plex users, security teams, and researchers
- Plex users: Keep Plex installations up to date. The report advises that in light of active exploitation, users should run the patched Plex Media Server release for optimal protection.
- Security teams and detections engineers: Monitor for the listed indicators — the IPs 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222, the miner delivery host 217.60.194[.]116, and domains in the proxystream[.]st family — and look for processes identified as "mylovelyminer" and artifacts matching "myawesomeproxy" as observed in VirusTotal.
- Researchers and threat intelligence analysts: The rapid timeline — a public PoC on October 16, 2026 and exploitation activity a day later — underscores how quickly technical disclosures can be weaponized; tracking reuse of the proxystream subdomains and AISURU-linked telemetry could clarify attribution and campaign overlap.
The practical record is stark: a chain of four vulnerabilities disclosed in late July and patched in early August was weaponized within a day of public PoC disclosure, yielding both covert proxyware and cryptocurrency mining on compromised hosts. For defenders, the immediate, verifiable steps are the ones reported by researchers themselves — apply Plex Media Server 1.43.3.10861 where appropriate, and watch the indicators tied to mylovelyminer, myawesomeproxy and the proxystream[.]st domains.
Source: The Hacker News — Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
