A honeypot caught Plex servers being hacked to mine Monero

The flaws

The Bored Hacker Blog documents attacks on Plex Media Server tied to CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, which the researcher zmain chained into remote code execution. The post says Plex's September 1 advisory covered version 1.43.2 and earlier.

What the honeypot saw

Attackers sent crafted requests to the player timeline endpoint that made the server fetch and run attacker-hosted code. The author logged Python-urllib requests from several IPs, including 45.194.92.222, 91.92.40.202 and 176.65.139.228. After outbound traffic was allowed, the honeypot downloaded a file from 217.60.194.116 containing a Docker file and an UPX-packed binary identified as xmrig, a cryptominer. A later update reported a proxy tool called "myawesomeproxy," which the author links to proxystream.st and the Aisuru botnet.

The write-up's author names the fixed build, and a miner is the cheap part

The fixed version and timeline came from a commenter who says they wrote the Plex2Shell write-up:

"the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week." — a commenter who says they wrote the Plex2Shell write-up

Victims were stuck on old builds without knowing it:

"I run Plex on Linux and I hadn't realized that they changed their apt repo URL at one point so I was way behind." — a victim who found a process named MyLovelyMiner pegging every core

And the miner is not the whole story:

"You absolutely cannot trust these machines even after you have removed the obvious cryptominer. … Erase the disk and install a new OS." — a commenter whose HN profile says "security person"

So the post's xmrig check is a floor. Update to 1.43.3.10861 or later (apt users should confirm the repo URL still tracks Plex's current one), and treat any internet-facing host that ran an older build as compromised, not merely mining.