Plex2Shell exploit chain weaponized hours after disclosure

· Cybersecurity

Threat actors have begun exploiting a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, roughly a day after a proof-of-concept went public. According to researcher boredhackerblog, the exploitation activity involves chaining four different flaws into what is being called Plex2Shell. The reverse proxy component gives attackers persistent remote access, while the miner monetizes compromised hosts. Plex Media Server is widely run on home and small-business systems that are often exposed to the internet, which makes fast weaponization especially consequential. The immediate effect is that unpatched Plex servers are being actively targeted, and administrators should treat exposed instances as at risk.

Why it matters：Rapid weaponization of public proofs-of-concept is now the norm, and internet-exposed media servers in homes and small businesses are a soft target that can be recruited into mining and proxy networks.

Key points

  • The exploit activity chains four vulnerabilities, per the researcher.
  • Attackers deployed cryptocurrency miners and reverse proxy software.
  • Exploitation began about a day after a public proof-of-concept.

Sources (original reporting)

More stories from this day