Threat actors are exploiting the Plex2Shell vulnerability chain in Plex Media Server following a public proof-of-concept.
The four flaws enable unauthenticated remote code execution, resulting in cryptomining payloads and Linux backdoors.
The attacks began just a day after information was released about how four different security flaws, a chain of vulnerabilities called Plex2Shell, can be combined. By exploiting these problems, those behind the attacks can gain access to computers remotely without the need for a password.
What do attackers install on compromised systems?
So far, the attacks have resulted in the installation of a cryptocurrency mining program called mylovelyminer, which connects to a specific destination on the Internet, as well as a hidden program known as myawesomeproxy that acts as a backdoor to Linux systems. A web address associated with this equipment has been previously identified in other similar automated actions.
Corresponding reports from users in online communities indicate that several systems have already been compromised with the same cryptocurrency program, although it remains unclear at this stage whether all of these cases stem from exactly the same set of problems.
READ ALSO
Hackers breached OpenCode and charged developers hundreds of dollars
When was the problem detected and how is it fixed?
These issues were discovered and reported to Plex by a security researcher on July 27, 2026. The company released an official update that fixes the security vulnerabilities in version 1.43.3.10861, which was released on August 3, 2026.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)