Security researchers have confirmed that cybercriminals are actively exploiting unpatched Plex Media Server installations to hijack home servers for cryptocurrency mining and proxy network operations. The attacks target a chain of vulnerabilities known as Plex2Shell, which were patched by the company months ago but remain present on thousands of internet-connected devices.
According to Spider’s Web, the exploitation campaign began immediately after technical details of the vulnerabilities were published online. Users who noticed their NAS devices, mini-PCs or home servers suddenly running at unusually high temperatures may be victims of the attack, which allows criminals to take complete control of unpatched systems.
Four flaws enable complete takeover
The Plex2Shell attack chain exploits four separate security vulnerabilities, designated CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. When combined, these flaws allow remote code execution without requiring any account credentials or authentication. Security researcher Zach Main published technical details and working proof-of-concept code, demonstrating how attackers can leverage server-side request forgery, hijack security tokens, and deliver malicious payloads to vulnerable devices.
Monitoring systems showed that active exploitation attempts appeared just one day after the technical information became public on 17 October. Researchers operating honeypot servers – deliberately vulnerable systems designed to observe attacker behaviour – recorded successful break-ins using the new vulnerability chain within hours of the disclosure.
Plex servers make particularly attractive targets for cybercriminals. They typically run 24 hours a day on NAS devices with permanent internet connections and possess significantly more computing power than typical routers or Internet of Things devices. Many are hosted on home IP addresses belonging to ordinary users, which appear more trustworthy than data centre infrastructure when used for malicious purposes.
Crypto miners and proxy networks installed
The first malicious payload identified by security researchers was a cryptocurrency mining application. Compromised computers use their processing power to generate digital currencies that flow into wallets controlled by the attackers. For server owners, this manifests as higher electricity consumption, elevated temperatures, louder fan operation and noticeable performance degradation.
More concerning is the installation of proxy software identified as “myawesomeproxy”. This application allows criminals to route internet traffic through the victim’s home connection, effectively using the compromised device as an exit point for their own online activities. Unlike cryptocurrency mining, which causes obvious processor load, proxy operations can remain undetected for extended periods whilst the owner’s internet connection facilitates someone else’s operations.
Users have begun reporting infections on online forums. One Reddit user described their server rack running unusually loudly due to high CPU load, later discovering a process called “mylovelyminer” linked to cryptocurrency mining operations. These reports suggest the problem extends well beyond laboratory observations and is affecting real-world installations.
Patches available since September
The current wave of infections is not the result of a zero-day vulnerability. Plex published security fixes on 1 September and recommended users update Plex Media Server to version 1.43.3. The detailed technical description and public proof-of-concept code emerged only later, yet thousands of installations remain unpatched.
This situation highlights a persistent gap between the availability of security updates and their actual implementation by users. In the self-hosting community, servers often run for months without intervention because everything appears to function correctly, leading administrators to postpone updates indefinitely.
What this means for Poles in the UK
If you run a Plex Media Server at home in the UK, particularly on a NAS or dedicated mini-PC, you should immediately check whether your installation is up to date. Access your Plex administration panel and verify that you are running version 1.43.3 or later, released on 1 September. If your server shows version 1.43.2 or earlier, update immediately.
Warning signs of compromise include unexplained high CPU usage, increased fan noise, elevated temperatures, or degraded streaming performance. Check your running processes for unfamiliar applications, particularly those with names containing words like “miner”, “proxy” or similar terms. If you discover an infection, disconnect the server from the internet, perform a clean reinstall of the operating system, and change all passwords associated with the device.
For servers exposed directly to the internet, consider placing them behind a VPN or restricting external access through firewall rules. Plex can function effectively without being directly internet-facing if you configure remote access through the official Plex infrastructure rather than port forwarding. Enable automatic updates if your system supports them, or establish a regular schedule to check for security patches manually. Home servers connected to the internet carry the same security responsibilities as any other web-facing system, and neglecting updates can turn your device into infrastructure for criminal operations whilst driving up your electricity bill and potentially exposing your home IP address to malicious traffic.