Attackers are exploiting Plex servers in the wild to plant a cryptominer

Plex vulnerabilities being exploited in the wild to drop a cryptominer

A security researcher set up a honeypot running a vulnerable Plex Media Server and caught real attacks in progress. Three IPs chained the plex2shell flaws (CVE-2026-96652 through 96656) to pull a Docker image and a packed binary, then ran XMRig. Later, a proxy tool called myawesomeproxy appeared, warning users that their internet traffic could be used externally — a hint that residential IPs, not just mining revenue, are the prize.