Plex Media Server vulnerabilities targeted by active malware attacks
Security researchers have identified active exploitation of unpatched Plex Media Server instances, leading to unauthorized installation of cryptominers and proxy software.
Plex Media Server users are being urged to update their software following reports that four recently patched vulnerabilities are being actively exploited by attackers. The vulnerability chain, dubbed 'Plex2Shell,' allows for remote code execution on devices running outdated versions of the server software.
Security analysts tracking the incidents noted that successful breaches result in the deployment of malicious payloads. Among the observed threats are cryptominers, which hijack system resources to generate digital currency for external actors, and residential proxy software. The latter allows third parties to route illicit internet traffic through the compromised host machine, effectively anonymizing their activities.
The issue stems from a series of security flaws, including one with a high severity rating of 8.6 out of 10, which were patched by Plex last month. Researchers who deployed honeypots to monitor the threat observed automated scanning and successful infection attempts within 24 hours of the exploit details being made public.
Users who have not yet updated their Plex Media Server installations remain at risk. Security experts recommend immediate patching to mitigate the threat of remote exploitation.