Recently fixed Plex Media vulnerabilities are being exploited to install malware
ars ·
Researchers have discovered that recently patched vulnerabilities in Plex Media Server are being actively exploited to install malicious software. The attack chain, dubbed "Plex2Shell," combines four distinct flaws to achieve remote code execution on unpatched devices. Successful intrusions result in the deployment of cryptominers or residential proxy applications, which attackers use to anonymize illegal internet traffic. One researcher utilized AI-assisted tools to develop a proof-of-concept exploit after identifying five vulnerabilities, including one with high severity. A honeypot setup confirmed that active scanning and successful infections began within days of the exploit details becoming public. Plex addressed these issues earlier in the month, but security experts urge users to update immediately to version 1.43.3. To mitigate risks, administrators are advised to restrict server access to local networks or utilize reverse proxies for internet exposure.
ars