Recently fixed vulnerabilities in Plex Media Server are under active exploitation, with attackers installing malware such as cryptominers and residential proxy software on compromised devices, according to a security researcher. The exploit chain, named Plex2Shell, combines four vulnerabilities to achieve remote code execution on vulnerable servers. The researcher who developed the chain said he used AI heavily during the process, but described it as hours of iterative work and judgment calls rather than a fully automated attack.
A separate researcher created a honeypot to track real-world exploitation and observed active scanning within a day, followed by successful infections. The residential proxy payload is especially concerning because it lets attackers route internet traffic through infected devices, potentially to reach corporate VPNs and email systems from residential IP addresses.
Plex patched the underlying vulnerabilities at the start of last month. Users should ensure they are running version 1.43.3, either through automatic updates or manual installation. The safest configuration is to restrict Plex access to local networks; if remote access is required, using a reverse proxy and strong passwords is recommended. Plex representatives did not immediately respond to requests for comment.