A researcher's decoy Plex Media Server was attacked on October 17, the researcher said. SecurityWeek reported on October 19 that this came a day after another researcher published a write-up and working exploit code for "Plex2Shell", a chain of four Plex flaws. SecurityWeek said the chain lets an attacker run code on an exposed server without a login. The attackers installed a coin miner built on XMRig, and later a program called myawesomeproxy.
The researcher's logs show the method. A crafted request to a Plex web address makes the server call itself, then fetch content from an address the attacker controls. SecurityWeek said the four flaws together turn this into code running with the Plex service's rights. The full chain is in the write-up. The decoy blocked outbound traffic at first, so payload data may be partial. The attackers may have altered the exploit. Neither source says how many real servers were hit.
SecurityWeek said Plex had fixes out from September 1, about six weeks before the exploit went public. Unpatched servers reachable from the internet are the ones at risk; the sources do not show local-only servers exposed. Ask three things: is any Plex server reachable from the internet, who owns it, and does its network reach company systems?