Plex vulnerabilities being exploited in the wild to drop a cryptominer
Summary
A security blog post describes in-the-wild exploitation of Plex vulnerabilities to drop a cryptominer. It lists CVEs (e.g., 2026-96652 to 2026-96656), observed attacker IPs, detection artifacts, and the attacker’s tooling (plex2shell), based on a honeypot experiment and public code. The piece documents IOCs, sample payloads, and ongoing exploitation activity, highlighting real-world risk to Plex deployments.