High 8.6
CVE-2026-96652
Plex Media Server Plex2Shell Exploit Chain Weaponized for Cryptomining and Proxyware
Vendor / product: Plex Media Server
Event date: 2026-10-16
Public PoC: Yes
First tracked by RiskWire: 2026-10-20
Named threat actors
AISURU botnet
Sources & citations (39)
- Plex Media Server Vulnerabilities Exploited for Miners bitnewsbot.com · 2026-10-19
- Faille Plex2Shell : Les serveurs Plex piratés pour miner de la cryptomonnaie generation-nt.com · 2026-10-20
- Your Plex Server Could Be Mining Crypto for Hackers aol.com · 2026-10-19
- Plex2Shell Exploit: 4 CVEs Hit Live Plex Servers [2026] shattered.io · 2026-10-19
- Gli hacker sfruttano le falle di Plex per installare malware data4biz.com · 2026-10-20
- Plex2Shell Exploitation Begins Within 24 Hours of Public Disclosure: Attackers Deploy Crypto Miners and Residential Proxy Software + Video undercodenews.com · 2026-10-19
- Falha Plex2Shell permite invasão e roubo de da... dailyjournal.news · 2026-10-19
- Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners securityaffairs.com · 2026-10-19
- Vulnerabilități severe din Plex exploatate activ. Actualizați-vă de îndată serverele! arenait.ro · 2026-10-20
- Plex2Shell Vulnerability: Patch Plex Server Now [2026] tech-insider.org · 2026-10-19
- Recently fixed Plex Media vulnerabilities are being exploited to install malware arstechnica.com · 2026-10-19
- Plex2Shell Exploit Is Live — Patch to 1.43.3.10861 Now byteiota.com · 2026-10-20
- Plex2Shell Exploitation Escalates: Attackers Deploy Crypto Miners and Linux Proxy Backdoors + Video undercodenews.com · 2026-10-20
- Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure securityweek.com · 2026-10-19
- Hackers Exploit Plex2Shell Flaws to Deploy XMRig Cryptominer the420.in · 2026-10-19
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor thehackernews.com · 2026-10-19
- Users confirm Plex running slow and hot due to malicious cryptominers neowin.net · 2026-10-19
- Plex2Shell: ataque instala minerador em servidores de mídia spacemoney.com.br · 2026-10-19
- Атаки на сервери Plex встановлюють майнери й проксі — Ars Technica ua.news · 2026-10-20
- Ataki na serwery Plex instalują koparki i proxy — Ars Technica ua.news · 2026-10-20
+19 more sources
References
See CVE-2026-96652 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →