SecurityWeek reports that threat actors have been observed using an exploit chain dubbed Plex2Shell against Plex servers, with attacks appearing within hours of the vulnerability being disclosed. The report does not name the specific flaw or the researchers who disclosed it, but the timing points to a rapid turnaround from public knowledge to active exploitation.
The observed campaign delivers cryptocurrency miners and proxy software to compromised servers. These payloads suggest the attackers are looking to hijack server resources for financial gain and to build out network infrastructure, rather than simply defacing or locking down systems.
Because the report is based on a single source, details on the scale of the campaign and the exact attack path remain limited. Still, the speed of weaponisation underscores how quickly known vulnerabilities can be turned into working exploits, and how important it is for Plex administrators to apply patches promptly.