Plex sent out a security announcement on September 1st, 2026, urging users to install important security updates for Plex Media Server v1.43.2 and earlier. The details were initially limited, so an infosec researcher running a honeypot with a vulnerable Plex version kept watching for exploitation. On September 26th, several CVEs were published, though none carried a CVSS score of 9 or higher. A linked blog post was released on October 16th, describing how the author chained several vulnerabilities together to achieve remote code execution. The researcher listed the CVEs as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and published proof-of-concept code and packet captures for detection work.
The honeypot initially recorded mostly scanning and generic exploitation attempts. On October 17th, the researcher observed in-the-wild exploitation. The first attempt came from 45.194.92.222, using a Python-urllib user agent to target the Plex timeline and agent search functionality. Other exploitation activity was traced to 91.92.40.202 and 176.65.139.228. After the researcher changed the honeypot configuration to allow outbound traffic, exploitation continued from 45.194.92.222, and a malicious file download was observed from 217.60.194.116. The downloaded Docker file contained a cryptominer.
The researcher noted that the cryptominer itself is not a major threat to victims, but suggested that attackers could deploy more sophisticated tools. Because Plex is often hosted on residential IP addresses, the researcher warned that attackers might use such systems as residential proxies to reach corporate VPNs and email accounts.
The researcher published indicators of compromise, including the exploiting IP addresses, the malicious download source and file hashes, to help defenders detect the attack. Plex users are advised to apply the security update as soon as possible.
Source: Hacker News · Summarized by HeadlinesBriefing