Plex Media Server Vulnerabilities Under Active Exploitation

Recently fixed vulnerabilities in the Plex Media Server are being actively exploited by attackers. The vulnerabilities, which were patched last month, allow for remote code execution and the installation of malware, including cryptominers and residential proxy apps. A researcher has revealed an exploit chain, dubbed 'Plex2Shell,' which chains four of the vulnerabilities together to achieve remote code execution. A honeypot set up to track attempts to exploit the vulnerability chain has seen active scanning and successful attempts to infect devices. The successful attacks are installing two payloads: a cryptominer and residential proxy software. The cryptominer uses the device to mine cryptocurrency, while the residential proxy software allows users to anonymize their internet activity.