TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A security researcher reported that attackers exploited a chain of Plex Media Server vulnerabilities against a honeypot on Oct. 17, 2026, and downloaded files identified as a cryptominer. A later update said the honeypot also recorded proxy software, but the researcher had not completed its analysis. The number of affected Plex servers and the attackers’ broader aims are unknown.
A security researcher reported that attackers exploited a chain of Plex Media Server vulnerabilities against a honeypot on Oct. 17, downloading files identified as a cryptominer. In an update the same day, the researcher also said the honeypot had recorded proxy software, widening the observed activity beyond cryptocurrency mining; the scale of attacks against real Plex users is not known.
The researcher, writing on Bored Hacker Blog, said the honeypot had previously recorded scanning and generic exploitation attempts but that the first activity they regarded as in-the-wild exploitation appeared on the morning of Oct. 17. The initial request came from 45.194.92.222, according to the researcher’s Zeek logs. Two other source addresses, 91.92.40.202 and 176.65.139.228, were also reported as attempting exploitation.
After changing the honeypot’s network settings to allow outbound traffic, the researcher observed continued activity from 45.194.92.222 and a file download from 217.60.194.116. The researcher identified the downloaded files as a cryptominer, listing hashes for the files in the post. Because outbound connections had initially been blocked and the honeypot configuration was changed during observation, the researcher cautioned that the collected data could be incomplete. They also said the attackers might have used modified techniques.
In a later Oct. 17 update, the researcher reported seeing a program called “myawesomeproxy” alongside another file identified as XMRig, a mining program. The post included hashes and links to analysis submissions, but the researcher said they had not had time to analyze the proxy software. The program’s own output, quoted in the post, said that running it meant agreeing to potential external use of the device’s internet traffic. That wording does not establish how the software was used in these attacks.
Risks Beyond Cryptomining
The reported activity matters to people running Plex Media Server because successful exploitation can place unauthorized software on a host, potentially consuming its computing resources for mining. The later observation of proxy software raises a separate concern: a compromised server’s network connection could potentially be used to route traffic. The researcher’s report does not establish that the software was used to access corporate networks, email accounts, or any particular service.
The observations come from a single honeypot, not a survey of Plex users or a count of compromised servers. They show that exploitation and payload delivery were observed in this environment, but they cannot establish how widespread the activity is, who is behind it, or what victims experienced. That distinction is important for users deciding how urgently to review exposed servers and for defenders evaluating indicators shared from the research.
The researcher published network captures and indicators of compromise for detection work, while the vulnerability researcher’s project also contains detection material. Those resources may help administrators investigate suspicious activity, but individual indicators such as IP addresses can change or become outdated. A match should be assessed alongside server logs, software versions, and other evidence rather than treated alone as proof of compromise.
Plex Media Server security hardware
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Plex Advisory to Exploitation
Plex sent users a security notice on Sept. 1, 2026, advising them about important updates for Plex Media Server version 1.43.2 and earlier, according to the Bored Hacker Blog report. The post’s author said details were initially limited and that they set up a vulnerable Plex version as a honeypot to watch for exploitation.
The researcher said vulnerability entries appeared on Sept. 26 and linked to a technical write-up that was published on Oct. 16. That write-up described chaining several issues to achieve remote code execution and listed CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The project’s code and detection resources are available on GitHub. The blog author said they tested the technique in a lab and shared packet captures to support detection work.
The Oct. 17 honeypot observations followed that public technical disclosure. The report is a researcher’s account of activity seen in a controlled environment; it is not an official Plex incident report or an independent confirmation of the reported payloads. The supplied material does not describe a confirmed Plex-wide breach.
As an affiliate, we earn on qualifying purchases.
Scope and Payload Use Remain Unknown
The report does not say how many public Plex servers were attacked or whether any real users were compromised. It also does not identify the operators, explain how long the activity had been underway, or show whether the same group was responsible for all the observed addresses and downloads.
The researcher said the honeypot initially blocked outbound traffic, which limited visibility into payload delivery, and later changed its configuration. They had not finished reviewing packet captures and described the collected evidence as potentially partial. The proxy program was also not fully analyzed in the post. Its presence and stated ability to use a device’s internet traffic do not, by themselves, establish what traffic it relayed or whether it was used for further intrusion.
The supplied material does not give a complete account of Plex’s recommended remediation beyond referring to the company’s Sept. 1 security notice and updates for affected versions. The exact status of each vulnerability, the conditions required for exploitation, and whether additional payloads are being deployed remain matters for further technical and vendor confirmation.
As an affiliate, we earn on qualifying purchases.
Patch, Review, and Monitor
Plex users should consult the company’s security announcement and install the applicable supported update, checking their server version rather than relying on the honeypot report alone. Administrators can review Plex and host logs for unusual requests or unexpected downloads and use the researcher’s published detection material as one input to an investigation. The report does not provide enough evidence to treat any single listed IP or hash as a complete detection strategy.
The researcher said they had posted additional artifacts and detections from the vulnerability researcher’s project. Further analysis of those files and packet captures may clarify how the miner and proxy behaved. Plex has not been quoted in the supplied material on the reported attacks, and no broader incident count or victim assessment is provided. Those details, along with confirmation of whether proxy activity is continuing, remain key developments to watch.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did the researcher observe?
The researcher reported exploitation attempts against a Plex honeypot on Oct. 17, followed by a download identified as a cryptominer. A later update said the honeypot also recorded proxy software and a file identified as XMRig.
Which Plex vulnerabilities were named?
The technical write-up referenced CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, describing them as a chain used to achieve remote code execution. Consult Plex’s security notice for the vendor’s guidance on affected versions and updates.
Does this show that Plex users were widely compromised?
No. The account describes activity on one researcher’s honeypot. It gives no count of affected public servers and does not confirm compromises of real users.
What should Plex server operators do?
Check Plex’s security announcement, update to an applicable supported version, and review server and host activity for unexpected requests or files. Treat the published indicators as investigation aids, not as proof on their own that a server is safe or compromised.
What is still unknown about the proxy software?
The researcher said they had not completed its analysis. The post does not establish what traffic it relayed, who controlled it, or whether it was used to reach other systems.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
