Plex2Shell: unauthenticated RCE chain (CVSS 10.0) already exploited in the wild, patch Plex now
evilsocket · x · 2026-10-19
A honeypot running Plex Media Server was compromised on Oct 17 via a chain of four recently disclosed CVEs (CVE-2026-96652/54/55/56), yielding unauthenticated RCE (CVSS 3.1: 10.0). Versions < 1.43.3.10828 are affected; fixed in 1.43.3.10861. Observed payloads include an XMRig miner and a proxy tool called myawesomeproxy routing traffic through residential connections. PoC, detection rules and IOCs (myawesomeproxy, mylovelyminer, --rig-id, proxystream[.]st) are public — update ASAP.
Related event: Actively Exploited Plex Vulnerability Chain Drops Miners on Old Servers(2 posts)→
More from Safety
- Dario's predictions on track: Mythos 'security tsunami' warning and 6-12 month China catch-up window — rickasaurus · 2026-10-23
- Boundless offers abliterated DeepSeek V4.1 Flash for defensive security testing — MoonL88537 · 2026-10-23
- php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Arista VeloCloud Orchestrator SQL injection flaw, CVSS 9.9, actively exploited — AIFlow_ML · 2026-10-23
- Bindu Reddy mocks AI security panic: world didn't end, but Anthropic says it'll get 'a lot worse' — bindureddy · 2026-10-23