Plex2Shell malware turns unpatched Plex servers into crypto miners
Researcher BoredHackerBlog spotted the campaign after setting up a Plex honeypot and posting the findings on Reddit.
Hackers are spreading malware called Plex2Shell to Plex servers that have not been updated since August 2026, turning unpatched, internet-facing machines into cryptocurrency miners. The campaign was first spotted by the researcher BoredHackerBlog, who set up a Plex honeypot and posted the findings on Reddit according to xda-developers.com.
Users have reported suspicious processes running on their servers, including ones named myawesomeproxy, mylovelyminer and x12345. The names point to a mining payload being dropped on compromised hosts.
Plex servers running version 1.43.3.10861 or later are protected against the exploit described. Servers below that version remain exposed if they are reachable from the internet.
Timeline of the fix
Plex2Shell was reported to Plex in late July 2026, and the exploit was fixed on August 4, 2026. Knowledge of the exploit was made public on October 16, 2026.
Owners of Plex servers should check their installed version and move to 1.43.3.10861 or later if they have not already done so.
Quick answers
What is Plex2Shell?
Plex2Shell is malware distributed to unpatched, internet-facing Plex servers, turning them into cryptocurrency miners.
Which Plex version is protected against Plex2Shell?
Plex servers running version 1.43.3.10861 or later are protected against the exploit described.
When did Plex2Shell become public knowledge?
The exploit was fixed on August 4, 2026, and knowledge of it was made public on October 16, 2026.