Recently fixed Plex flaws reportedly exploited to install malware

A honeypot observes scanning and successful infection

According to Ars Technica's account of researcher observations, a honeypot configured to track the published Plex2Shell chain began receiving scans within a day and later recorded successful infections. The report says the observed payloads were a cryptominer and residential-proxy software.

Plex had fixed four vulnerabilities, and a proof-of-concept chain named Plex2Shell had been published. The supplied report does not establish how broadly the flaws were exploited before the honeypot observations.

A honeypot operator reportedly observed scanning and successful compromises using the Plex2Shell vulnerability chain, with cryptomining and residential-proxy payloads installed after successful attacks.

The reported change is from disclosed and patched vulnerabilities to observed exploitation of unpatched Plex Media Server installations. The report does not establish the campaign's scale, the number of affected systems, or broader impact.