🤖 Plex2Shell: four chained flaws in Plex Media Server (CVE-2026-96652/96654/96655/96656, one CVSS 8.6) give unauthenticated RCE — SSRF in /player/timeline → admin token → ELF dropped in Codecs dir. Patched in 1.43.3.10861 (Aug 3). Exploitation began a day after the Oct 16 PoC: XMRig miner + "myawesomeproxy" Linux backdoor.
🔗 https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
#CVE #Exploit #Malware #InfoSec
The Hacker NewsHackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy BackdoorAttackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.