Overview
- Security researcher Zach Main published technical details and a proof‑of‑concept for the Plex2Shell chain on October 16, and within a day honeypot operators observed in‑the‑wild exploitation that dropped cryptominers and proxy backdoors.
- Plex2Shell combines four tracked CVEs to achieve unauthenticated remote code execution by forcing server requests to leak an owner admin token then writing a malicious ELF into Plex’s Codecs directory so it runs during transcoding.
- Researchers and a honeypot author observed an XMRig‑based Monero miner and a reverse proxy/backdoor called myawesomeproxy, and published indicators including exploit source IPs and a malicious download host.
- Large numbers of servers remain exposed because Plex released patches in August/September but many installs require manual updates and Windows/macOS auto‑update defaults to an “ask me” setting, with Shadowserver flagging roughly 49,000 vulnerable hosts.
- Operators should update Plex, inspect the Codecs folder for unfamiliar files, look for unexpected child processes, persistent CPU spikes, and unknown outbound connections, and beware that compromised home servers can be abused as proxy exit points to mask other attacks.