Unpatched Plex Media Servers Targeted by Hackers Deploying "Plex2Shell" Cryptojacking Malware

The convenience of "set-and-forget" technology is a double-edged sword for digital enthusiasts and home server hobbyists alike. While automating a home media environment ensures that libraries of movies, television shows, and personal media remain accessible around the clock with minimal friction, it often fosters a dangerous sense of complacency. When devices quietly fade into the background of a household or enterprise network, administrators frequently overlook the critical maintenance routines required to keep them secure.

This oversight has recently become the vector for a widespread wave of cyberattacks. Cybersecurity researchers and community administrators have discovered that malicious actors are actively exploiting unpatched vulnerabilities in Plex Media Server installations, deploying a dangerous new malware strain dubbed "Plex2Shell" to hijack internet-facing servers and convert them into unauthorized cryptocurrency miners.

Plex2Shell is Turning Unpatched Plex Servers into Cryptominers

The ongoing campaign was brought to light by security researchers at BoredHackerBlog, who deliberately established a Plex honeypot—a decoy server configured with known vulnerabilities—to observe and analyze how hackers interact with exposed infrastructure. After monitoring a sharp uptick in malicious activity, the researchers took to online communities, including Reddit, to alert self-hosters and system administrators to check their systems for signs of compromise.

In a post detailing the threat, the researchers advised administrators running older, internet-facing instances of Plex—particularly those deployed on Linux distributions or within Docker containers—to inspect their active process lists. They suggested running command-line diagnostics, such as ps axjf, to view the process tree and identify any suspicious child processes stemming from the main Plex Media Server execution path.

The forensic markers associated with the Plex2Shell infection include unusual process names such as myawesomeproxy, mylovelyminer, or generic alphanumeric identifiers like x12345. Investigators also noted unauthorized instances of utility tools like wget or curl fetching malicious script files from external internet protocol addresses. Furthermore, security audits revealed that the malware’s command-line arguments frequently feature specific operational tags, including --rig-id, connections routed through proxystream[.]st, and parameters controlling the --donate-level of the illicit mining operations.

Following the public warning, system administrators across the globe flocked to online discussion boards. Numerous users reported identifying these rogue processes hidden deep within their server environments, while others pointed to parallel threat-tracking threads on dedicated self-hosting forums where community members had independently flagged unusual CPU spikes and unauthorized background tasks running inside their Docker containers.

The malicious framework behind these attacks, identified as Plex2Shell, relies on a combination of software vulnerabilities that were initially reported to Plex developers in late July 2026. Prompted by the disclosure, the platform’s security team engineered and released patches to remediate the flaws, with fixes officially rolling out on August 4, 2026. While the technical details and specific mechanics of the exploits were kept under wraps to allow users time to secure their systems, full knowledge of the vulnerabilities became publicly available on October 16, 2026.

According to official advisories tracked under vulnerability identifier CVE-2026-96654—which covers one of the four distinct exploits leveraged by the Plex2Shell framework—all Plex Media Server installations running version 1.43.3.10861 or any subsequent release are fully protected against this specific attack vector.

Despite the availability of these patches for several months, a significant number of deployment administrators have failed to apply the updates. Because many home servers and media hubs are left running indefinitely without scheduled maintenance routines, hackers continue to scan the public-facing internet for vulnerable endpoints. By exploiting these neglected installations, the attackers manage to bypass authentication barriers, establish persistence, and quietly saddle unsuspecting users with resource-heavy cryptojacking software that degrades hardware performance and drives up electricity consumption.

Industry experts and security professionals emphasize that internet-facing media servers require the same rigorous update discipline as commercial enterprise infrastructure. For users who maintain a Plex server exposed to the broader internet and have neglected system updates over the past couple of months, security analysts strongly recommend performing an immediate audit of active processes and applying the latest software patches to prevent unauthorized exploitation.