Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
CVE-2026-96652 (5.3 med) Plex Media Server SSRF
CVE-2026-96654 (6.9 med) Plex Media Server URL injection
CVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF
CVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write
#threatintel #plex #IOC #eitw
ssvc
npub1wf…25hsj
2026-10-19 13:22:57 UTC
Author Public Key
npub1wfmch5l920u6ds7c5uq9ey99q9h2pmmmtpg2fkz8nqtd30auw3ds225hsjSeen on
wss://relay.ditto.pubPublished at
2026-10-19 13:22:57 UTCEvent JSON
{
"id": "4ce361c3725ce108fc8814a85c37835d4db8da24c052036ad5ad353ffce967a9",
"pubkey": "72778bd3e553f9a6c3d8a7005c90a5016ea0ef7b5850a4d8479816d8bfbc745b",
"created_at": 1792416177,
"kind": 1,
"tags": [
[
"t",
"threatintel"
],
[
"t",
"plex"
],
[
"t",
"ioc"
],
[
"t",
"eitw"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117467786626782392",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Plex2Shell chain exploited in the wild for cryptomining against Plex media servers: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html\n\nCVE-2026-96652 (5.3 med) Plex Media Server SSRF\nCVE-2026-96654 (6.9 med) Plex Media Server URL injection\nCVE-2026-96655 (5.3 med) Plex Media Server arbitrary-host SSRF\nCVE-2026-96656 (8.6 high) Plex Media Server arbitrary file write\n\n#threatintel #plex #IOC #eitw",
"sig": "7862088443e862060751a7ffda24760a5b91e9b4bfaad7acd38bb4d816018e6631552c9fe1543c1722f32ea4fb71f35a3e28d1392bc4d85ae5a096d4ab27f6ee"
}