Plex Media Server vulnerabilities exploited for crypto miners and Linux proxy backdoor
Threat actors have started exploiting a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software. This exploitation began just one day after a proof-of-concept (PoC) was made public.
Summary: Threat actors have started exploiting a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software. This exploitation began just one day after a proof-of-concept (PoC) was made public.
Plex Media Server is a popular software that allows users to organize and stream their media content. This news indicates that a chain of vulnerabilities in Plex, dubbed Plex2Shell, is being actively exploited. Attackers are using these flaws to install cryptocurrency miners and Linux-based reverse proxy backdoors on compromised systems.
Such vulnerabilities typically stem from critical flaws like remote code execution (RCE) or privilege escalation. The release of a PoC often accelerates attackers’ ability to automate exploitation and conduct widespread scans. Reverse proxy backdoors allow attackers to gain access to other networks or conceal their traffic through the compromised systems.
From a live systems and infrastructure perspective, this situation poses a severe security risk for all environments using Plex Media Server. Cryptocurrency miners degrade performance by consuming system resources, while backdoors serve as a bridge for long-term access and further attacks. Administrators must urgently update their Plex installations and monitor network traffic.
This incident once again highlights how critical the “patch gap” or “window of vulnerability” is after a PoC is released. Rapid application of security updates and regular security scans of systems are fundamental steps in protecting against such attacks.
🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar