TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A security researcher reported exploitation of vulnerabilities in older Plex Media Server versions against a honeypot on Oct. 17, 2026. The observed activity downloaded a cryptominer and, in a later update, a proxy tool; the report does not establish how many real Plex servers were affected.
A security researcher says attackers exploited vulnerabilities in older Plex Media Server versions against a honeypot, downloading a cryptominer and later a tool described as a proxy. The observations, reported on Oct. 17, 2026, show that attacks had moved beyond scanning in this researcher’s environment, but do not confirm how many public-facing Plex servers were compromised.
The researcher wrote that the honeypot initially recorded scanning and generic exploitation attempts. The first exploitation attempt the report identified came from 45.194.92.222; two other source IP addresses, 91.92.40.202 and 176.65.139.228, were also observed making exploitation attempts. The report does not independently establish who operated those addresses.
After changing the honeypot’s outbound traffic settings, the researcher observed continued activity from 45.194.92.222 and a file download from 217.60.194.116. The researcher identified the downloaded artifacts as a cryptominer and published file hashes and network indicators. Because outbound access had initially been restricted and the researcher had not yet reviewed all packet captures, the report cautions that its collected evidence may be partial.
In a later Oct. 17 update, the researcher said additional activity included a program called “myawesomeproxy”, alongside another XMRig cryptominer artifact. The program’s name and its displayed message suggest proxy functionality, but the report says the researcher had not completed its analysis. The findings are observations from one honeypot, not a measurement of infections across Plex users.
A Miner Is Not the Only Payload
The report matters because it provides an account of active exploitation following publication of technical details about a vulnerability chain that can lead to remote code execution. A successful attack on an exposed, vulnerable media server can let an attacker run code on the host, rather than merely probe it. In this observed case, the immediate impact included a miner that can consume system resources and potentially raise electricity use or reduce server performance.
The later proxy-tool observation may point to a broader risk, but remains preliminary. If a compromised home server is used to route other parties’ traffic, its residential internet connection and reputation could be misused. The researcher connected the observed traffic to proxy-related infrastructure, but did not establish the tool’s purpose, deployment scale, or whether it was used to reach corporate services. That possibility should not be treated as a confirmed impact of these attacks.
For Plex users, the practical concern is whether a server is running an affected version and reachable by an attacker. The honeypot report alone cannot answer whether any particular user has been compromised. It does show why users and administrators should take the vendor’s security update seriously, review exposure and update status, and investigate unexpected processes or outbound connections.
Plex Media Server security update
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Plex Update to Exploitation
Plex announced an important security update on Sept. 1, 2026, according to the researcher, and said its notice covered Plex Media Server version 1.43.2 and earlier. The researcher set up a honeypot running a vulnerable version to watch for exploitation. The initial security notice provided limited technical detail, the report says.
The researcher says vulnerability entries appeared on Sept. 26 and later linked to a technical post by the vulnerability discoverer. That post was updated on Oct. 16, describing a chain of several vulnerabilities that could produce remote code execution. The report lists CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 and links to the discoverer’s code and detection materials. The observed honeypot exploitation followed on Oct. 17.
The researcher also published packet captures and collected indicators on GitHub to support detection work. Those materials document what was seen in this honeypot; they are not, by themselves, confirmation that every listed indicator is tied to all attacks or that all exploitation uses the same technique.
“As of this morning (Oct 17th), I finally saw in the wild exploitation.”
— BoredHackerBlog researcher
Scope and Proxy Use Remain Unknown
The report does not say how many real Plex servers were targeted or compromised, whether the honeypot’s results represent broader attack activity, or whether the listed source addresses identify the attackers rather than intermediary systems. The researcher also warned that the initial outbound traffic restrictions may have prevented collection of some payloads and that attackers could have used modified code or techniques.
The proxy tool had not been fully analyzed when the update was posted. Its relationship to the cryptominer activity, any connection to the proxy infrastructure mentioned by the researcher, and any actual use of infected servers to route third-party traffic remain unconfirmed. The report also does not establish whether the observed miner successfully ran beyond the honeypot environment or how long any activity lasted.
Patch and Monitor Exposed Servers
Plex users and administrators should check Plex’s security notice for the affected versions and install the applicable security update. Those responsible for servers should also review whether the service is exposed to the internet and look for unexplained processes, downloads, or outbound traffic. The researcher linked to detection guidance and indicators, which defenders can use as supporting material rather than as proof of compromise on their own.
The researcher said packet captures and artifacts were being added to GitHub and opened a discussion asking whether other Plex users had been affected. Further analysis of the proxy tool and reports from other users could clarify the scope and payloads. At the time of the report, no broader victim count or independent confirmation of widespread compromise had been provided.
Key Questions
What did attackers install on the Plex honeypot?
The researcher observed a download identified as a cryptominer. A later update reported a program called “myawesomeproxy,” but its behavior and role had not been fully analyzed.
Which Plex versions are covered by the security notice?
The researcher says Plex’s Sept. 1 notice concerned Plex Media Server version 1.43.2 and earlier. Users should consult Plex’s own notice for affected versions and update instructions.
Does the report show that many Plex users were compromised?
No. It documents activity against one researcher’s honeypot and does not provide a count of affected real-world servers or users.
Was the proxy tool definitely used to route traffic?
That is not established. The researcher reported seeing a tool named “myawesomeproxy” and quoted a message about external use of a device’s internet traffic, but said the program had not yet been fully analyzed.
What should Plex server operators do?
Check Plex’s security advisory and apply the relevant update. Administrators can also review internet exposure and investigate unexpected processes or network activity; the reported indicators are useful for investigation but do not alone prove a server is infected.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
