- Researcher boredhackerblog's honeypot, a decoy Plex server, was attacked on October 17, a day after the Plex2Shell exploit code was published. It received a cryptominer and a proxy program.
- The proxy matters more than the miner. The researcher fears it could let attackers borrow home internet connections to reach company systems. That is a judgment, not an observed outcome.
- Confirm that anyone running Plex Media Server is on version 1.43.3.10861 or later. Ask whether home devices that reach company systems are tracked.
The cryptominer is the least interesting part of this story. A second program installed in the same attacks matters more. Researcher boredhackerblog runs a honeypot (a decoy server built to attract attackers). It received both programs on a vulnerable Plex Media Server this month. The second program is a proxy, which can pass someone else's traffic through the victim's network connection.
What happened
Security researcher Zach Main reported a set of Plex Media Server flaws to Plex on July 27, 2026, according to The Hacker News. Plex fixed them in version 1.43.3.10861 on August 3. Main chained the flaws into a way to run code on a server without logging in. He published the technical write-up and exploit code on October 16.
Boredhackerblog had been running a vulnerable Plex version as a honeypot since Plex's September 1 security notice. For weeks it saw mostly scanning and generic attacks. On October 17 it recorded real exploitation. The Hacker News describes this as a day after the write-up went public.
How the chain works
The Hacker News lists four chained flaws. Most score in the medium range on the CVSS severity scale, with one rated 8.6. The other three score between 5.3 and 6.9. Each step looks modest alone, but the chain is worse than any single score suggests.
First, CVE-2026-96652 (CVSS 5.3) is a server-side request forgery, which means tricking a server into making requests on an attacker's behalf. In Plex's "/player/timeline" endpoint, a "protocol" parameter is placed into a web address with no checks. An outsider can make the server send a request wherever they choose.
Second, CVE-2026-96654 (CVSS 6.9) lets an attacker call other plugins' functions through the "searchOne" endpoint. The aim is to obtain the owner's admin token, the credential that proves who runs the server. The request that boredhackerblog logged points at this endpoint, from inside the server itself.
Third, CVE-2026-96655 (CVSS 5.3) is another request-forgery flaw. With the admin token, an attacker can make the server fetch a video file from an address they control. That file carries a malicious Linux program.
The fourth, CVE-2026-96656 (CVSS 8.6), is described as external control of a file name or path. The full description of this flaw is not available to us. The Hacker News also names CVE-2026-96651 (CVSS 7.1) as disclosed alongside these. No description of that one is available either.
The lesson is that a chain of flaws, most of them scoring in the medium range, can add up to code execution without a login. Scoring each flaw alone can hide that.
What the attackers installed
In the honeypot logs, the first attack came from 45.194.92.222. A file download from 217.60.194.116 followed once the researcher allowed outbound traffic. Boredhackerblog then saw an XMRig cryptocurrency miner. The Hacker News says it points to a mining server at ota.proxystream[.]st.
The attackers also delivered a program called "myawesomeproxy." The Hacker News cites VirusTotal as describing it as a stealthy Linux backdoor and reverse proxy. When run, it prints: "Running this software on any of your devices makes you agree to the potential external use of your internet traffic."
The Hacker News adds that this domain has appeared before. In August 2026, it reports, Bitsight connected a sibling address, global.relay.proxystream[.]st, to AISURU, a botnet that runs denial-of-service attacks and proxy services. Boredhackerblog says there was no time to analyse myawesomeproxy. The researcher posted the samples to GitHub, and the file hashes are in the blog post.
Why a media server is a business problem
Boredhackerblog notes that Plex servers can sit on home internet connections. In the researcher's view, attackers would value such addresses for reaching corporate VPNs and email while looking like an ordinary household. That is the researcher's judgment, not an observed outcome. Neither source describes a corporate break-in linked to this campaign.
This is the shift worth seeing. The value of a compromised device may lie in where it sits, not in what it holds. A forgotten server in an employee's home can be a way to borrow a trusted address.
What is not known
The honeypot blocks outbound traffic by default. The researcher had to change that setting, so the payload record is partial. Attackers may also be using modified code. The Hacker News notes that Reddit users report compromises with the same miner, but it is not known whether Plex2Shell caused them. It also says it is unclear whether Plex's September alert covered these flaws. The outlet has asked Plex for comment.
This is one honeypot and one campaign. It does not show a wider trend.
What to ask your team
Ask whether any staff run Plex or similar self-hosted software at home on devices that also reach company systems. Ask how the company would know. Ask whether remote-access logins from home connections are checked for unusual patterns.
Anyone running Plex Media Server should confirm they are on 1.43.3.10861 or later. Boredhackerblog and Main have both published detection material for security teams. The patch was 75 days old when the honeypot recorded its first exploitation, and the exploit code was one day old.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: boredhackerblog.
