Our takePlex2Shell's public PoC triggered in-the-wild exploitation within a day; attackers are dropping XMRig miners and proxy backdoors on unpatched Plex Media Servers. Patch now.Security Resilience desk
Sources (3)
- the420_in · the420_in
- hackernews · hackernews
- the420_in · the420_in
What this means for you — Security leader:Plex Media Server instances exposed to the internet should be updated immediately or placed behind strict WAF rules; the Plex2Shell chain is now being used in the wild to drop XMRig miners and proxy backdoors.
What this means for you — Lean IT orgs:If you run a Plex Media Server and can reach it from the internet, update it right away or turn off remote access; attackers are already using a newly released exploit to install cryptominers.
What this means for you — MSP:Scan client environments for internet-exposed Plex Media Servers and apply the latest updates; the Plex2Shell exploit chain is actively delivering XMRig miners and reverse proxies in the wild.
What this means for you — Researcher:The Plex2Shell chain moved from public PoC to in-the-wild exploitation within 24 hours; monitor for XMRig and proxy backdoor deployments on any exposed Plex instances.