#BitcoinSurpasses$83,000 olso Plex Server Exploited via Unauthenticated RCE Chain to Mine Crypto and Proxy Traffic
A newly disclosed unauthenticated remote code execution chain in Plex Media Server is being actively exploited to turn vulnerable home servers into crypto miners and residential proxies.
Security researcher ZM published a technical write-up on Thursday detailing the Plex2Shell chain, which combines four vulnerabilities (CVE) and affects all server versions before 1.43.3.10861.
The exploit allows an attacker without login credentials to steal the admin token and plant a malicious file that executes each time Plex transcodes a video.
On Saturday the honeypot operator observed the chain in the wild, first delivering a crypto miner and later a tool called myawesomeproxy that routes traffic through the compromised machine without the owner's knowledge.
#BitcoinSurpasses$83,00
Shadowserver data from Saturday shows roughly 49,000 hosts still running vulnerable Plex builds, including about 25,100 in North America and 17,600 in Europe.
Plex issued a fix on August 4, paid a $500 bug bounty to ZM on that date, and released a public advisory on September 1 urging all server owners to update immediately.
Despite the warning, many users have not applied the patch, leaving their internet connections exposed to the ongoing attacks.
Security experts, including Kraken's Chief Security Officer, reiterated the urgency, noting that the payload persists in Plex's Codecs folder and reactivates with each transcoding task.
A newly disclosed unauthenticated remote code execution chain in Plex Media Server is being actively exploited to turn vulnerable home servers into crypto miners and residential proxies.
Security researcher ZM published a technical write-up on Thursday detailing the Plex2Shell chain, which combines four vulnerabilities (CVE) and affects all server versions before 1.43.3.10861.
The exploit allows an attacker without login credentials to steal the admin token and plant a malicious file that executes each time Plex transcodes a video.
On Saturday the honeypot operator observed the chain in the wild, first delivering a crypto miner and later a tool called myawesomeproxy that routes traffic through the compromised machine without the owner's knowledge.
#BitcoinSurpasses$83,00
Shadowserver data from Saturday shows roughly 49,000 hosts still running vulnerable Plex builds, including about 25,100 in North America and 17,600 in Europe.
Plex issued a fix on August 4, paid a $500 bug bounty to ZM on that date, and released a public advisory on September 1 urging all server owners to update immediately.
Despite the warning, many users have not applied the patch, leaving their internet connections exposed to the ongoing attacks.
Security experts, including Kraken's Chief Security Officer, reiterated the urgency, noting that the payload persists in Plex's Codecs folder and reactivates with each transcoding task.