Threat actors are actively exploiting a series of vulnerabilities in Plex Media Server, collectively termed Plex2Shell, to install cryptocurrency miners and reverse proxy software.
This exploitation began just one day after a proof-of-concept for the vulnerabilities became publicly available.
A researcher known as boredhackerblog identified that the exploitation involves chaining together four distinct vulnerabilities.
Sources and references
Original report
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00VKP5HQ
Cite this
APA
Interestana AI Editorial. (2026, October 19). Hackers Exploit Plex2Shell Flaws for Crypto Miners. Interestana. https://interestana.com/articles/hackers-exploit-plex2shell-flaws-to-install-crypto-miners-and-linux-proxy-backdoor-00vkp5hq
MLA
“Hackers Exploit Plex2Shell Flaws for Crypto Miners.” Interestana, 19 Oct. 2026, interestana.com/articles/hackers-exploit-plex2shell-flaws-to-install-crypto-miners-and-linux-proxy-backdoor-00vkp5hq.
Chicago
Interestana AI Editorial. “Hackers Exploit Plex2Shell Flaws for Crypto Miners.” Interestana, October 19, 2026. https://interestana.com/articles/hackers-exploit-plex2shell-flaws-to-install-crypto-miners-and-linux-proxy-backdoor-00vkp5hq.
BibTeX
@misc{interestana_00vkp5hq,
author = {{Interestana AI Editorial}},
title = {{Hackers Exploit Plex2Shell Flaws for Crypto Miners}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/hackers-exploit-plex2shell-flaws-to-install-crypto-miners-and-linux-proxy-backdoor-00vkp5hq},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html}
}Credit the source
Original reporting: The Hacker News, “Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor”, https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe