Recently patched vulnerabilities in Plex Media Server are being actively exploited by cybercriminals to install malicious software, including cryptocurrency miners and residential proxy applications, according to cybersecurity researchers. The attacks target vulnerable servers and could allow attackers to execute malicious code on affected devices.
The discovery highlights the importance of applying security updates promptly, especially for media servers that are accessible over the internet.
Plex2Shell Exploit Targets Vulnerable Media Servers
Plex recently released security fixes for multiple vulnerabilities affecting Plex Media Server. Although four vulnerabilities were initially addressed, subsequently published CVE identifiers revealed five vulnerabilities, including one with a severity score of 8.6 out of 10.
A security researcher later demonstrated an exploit chain that combines four vulnerabilities to achieve remote code execution on devices running vulnerable versions of Plex Media Server. The exploit chain was named Plex2Shell.
Remote code execution is a serious security risk because it can allow an attacker to run unauthorized commands on a targeted system, potentially leading to malware infections, data exposure, and further compromise.
Following the disclosure of the exploit, another researcher established a honeypot, a simulated server designed to monitor malicious activity and detect real world attack attempts.
Within 24 hours, the honeypot began recording active scans targeting the vulnerable Plex configuration. Researchers subsequently observed successful exploitation attempts that resulted in malware infections.
Cryptominers and Residential Proxy Malware Detected
Researchers have identified two types of malicious payloads deployed through these attacks.
Cryptocurrency Mining Malware
The first payload is cryptocurrency mining software that secretly uses the infected device's computing resources to mine digital currencies for the attacker.
Cryptomining malware can increase CPU usage, slow down server performance, raise electricity consumption, and cause additional hardware wear. Because the mining activity runs without the owner's permission, victims may experience performance problems without immediately identifying the cause.
Residential Proxy Software
The second payload is residential proxy software. This type of application allows third parties to route their internet traffic through an infected device, making that device appear to be the source of their online activity.
Although residential proxies can have legitimate uses, unauthorized proxy software can expose victims to significant security and legal risks. Malicious users may exploit these connections to conceal their identities, conduct abusive activities, or route suspicious traffic through compromised networks.
When installed on a Plex server, this software can turn the device into an unwitting intermediary for third party internet traffic.
How the Plex2Shell Exploit Works
The Plex2Shell exploit chain combines multiple security weaknesses to gain control over a vulnerable server. According to the researcher who disclosed the proof of concept, the process involves several stages, beginning with an unauthenticated server side request forgery vulnerability and progressing through additional security weaknesses.
The reported attack chain includes unauthenticated server side request forgery, a loopback pivot, security token theft, payload delivery, and execution of the malicious payload.
By combining these weaknesses, an attacker can potentially move from an initial network request to executing unauthorized code on the targeted device.
The researcher submitted the proof of concept as part of a vulnerability report to Plex. The disclosure subsequently helped another researcher reproduce aspects of the attack in a controlled honeypot environment and observe exploitation attempts in the wild.
Artificial Intelligence Assisted Vulnerability Research
The researcher behind Plex2Shell also explained that artificial intelligence tools played a significant role in developing the exploit.
Rather than relying on a single automated instruction, the process involved breaking the application into logical components, examining possible paths from user input to vulnerable operations, investigating individual weaknesses, and independently checking whether suspected vulnerabilities were genuine.
The researcher described the work as an iterative process that required hours of investigation, testing, and prioritization.
According to the researcher, AI accelerated the analysis and development process while human judgment remained central to deciding which components to investigate and which findings to pursue.
The case illustrates how AI assisted security research can help identify and connect complex vulnerabilities. It also demonstrates how the same technical discoveries can create risks when vulnerable systems remain exposed and attackers adopt publicly disclosed exploit techniques.