Plex shipped fixes in 1.43.3 by Sep 1, yet one researcher's honeypot running a vulnerable version was exploited on Oct 17, a day after the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) went public. He saw an XMRig miner and a proxy tool dropped. Plex's Sep 1 notice listed no CVEs, and Plex did not immediately respond to Ars Technica.
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
www.boredhackerblog.infoPlex vulnerabilities being exploited in the wild to drop a cryptominerIntro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitati...