A security researcher running a honeypot with a vulnerable Plex Media Server instance has confirmed active in-the-wild exploitation of a critical vulnerability chain disclosed on September 1st, 2026. Four CVEs — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 — were chained together by researcher zmain to achieve remote code execution, with the full technical writeup and exploit code published on October 16th. Within 24 hours, the honeypot lit up. The exploit chain works by abusing Plex's player timeline subscription endpoint to trigger a server-side request forgery, bouncing requests through sslip.io DNS to reach an attacker-controlled server. The attack tooling uses Python's urllib and targets the default Plex port 32400. Three distinct IP addresses — 45.194.92.222, 91.92.40.202, and 176.65.139.228 — were observed conducting exploitation, with malicious payloads served from 217.60.194.116. The initial payload is straightforward: a Docker container running a cryptominer. XMRig hashes and a secondary binary were recovered from the honeypot. But the second wave is more concerning. An update from the researcher found a binary called "myawesomeproxy" being deployed, which prints a consent notice on execution: "Running this software on any of your devices makes you agree to the potential external use of your internet traffic." This is a residential proxy agent — it turns compromised home servers into exit nodes for third-party traffic. The proxy component ties to proxystream.st and shows similarities to the Aisuru botnet infrastructure documented by Bitsight. This is the real extraction: Plex servers sit on residential IP addresses, behind consumer ISPs, often on always-on hardware with decent bandwidth. A residential proxy network built from compromised Plex instances gives operators IP addresses that bypass corporate VPN geofencing, CAPTCHA systems, and fraud detection — capabilities worth significantly more than the pennies earned from cryptomining. Plex patched the vulnerabilities in version 1.43.3 and later, but the self-hosted nature of Plex means patch adoption is entirely user-driven. There is no forced update mechanism. The vulnerable population is exactly the demographic least likely to monitor security advisories: home media enthusiasts running always-on servers, often port-forwarded through consumer routers with no intrusion detection. The researcher published pcaps, file hashes, sandbox analysis links, and detection signatures on GitHub. The original vulnerability discoverer (code-zm) also released detection rules. The 46-day gap between Plex's initial security announcement on September 1st and the public exploit code on October 16th gave a narrow patch window, but exploitation began essentially the day after full details dropped. The speed of weaponization — under 24 hours from PoC to in-the-wild exploitation — reflects the value attackers place on this target class. The structural risk here extends beyond individual Plex installations. Every unpatched Plex server is a potential residential proxy node, and the installed base is large enough to matter. Plex has over 30 million registered users, and while not all self-host, the subset that does represents a high-value target for botnet operators who monetize residential IP access at scale.
