Attackers are exploiting a chain of four Plex Media Server vulnerabilities to install cryptocurrency miners and residential proxy software, a day after a researcher published working proof-of-concept code. Plex patched the flaws in August, so the victims are servers that were never updated.

Researcher Zach Main published his write-up and exploit code for the chain, which he named Plex2Shell, on October 16. A separate researcher running a vulnerable honeypot saw successful attacks the next day, SecurityWeek reported .

The vulnerabilities are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 and affect Plex Media Server versions before 1.43.3.10861. Three of them score between 5.3 and 6.9 on the CVSS scale, while the fourth, CVE-2026-96656, rates 8.6. Chained together, they let an unauthenticated attacker run code on the server with the privileges of the Plex service.

The chain starts with a server-side request forgery through the /player/timeline endpoint.…