Plex vulnerabilities being exploited in the wild to drop a cryptominer

2OEH8eoCRo0

Reddit discussion here: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exp... Affects an older version of Plex and was patched in August.

foobarian

> internet-facing Plex servers This is terrifying. Who runs things like this open to the outside?

xavdid

I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software". After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying. I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).

iamjackg

Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."

coreyburnsdev

I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?

basilikum

It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.

NelsonMinar

Lots of reports on Reddit about people getting popped. Other payloads too, like a DDOS node. Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell

zm_0x

Author of the writeup here. For anyone running PMS: the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week. If you want to know whether you were hit, the repo has a detection/ directory with YARA rules and a read-only hunt script (github.com/code-zm/plex2shell). Happy to answer questions about the chain.

joecool1029

If you're on Gentoo, I've been keeping this maintained in their main tree. Had the patched version available for users since July 15th... I also maintain a netbird ebuild in my overlay if you want a FOSS alternative to tailscale to put it behind.

drfuzzy89

I got hit with this. I run Plex on Linux and I hadn't realized that they changed their apt repo URL at one point so I was way behind. Luckily, the whole attack was hilariously incompetent. All of my cores were pegged at 100 so Plex was unusable so I went to investigate and immediately found a process called MyLovelyMiner. I imagine someone trying to run an illicit crypto miner on other people's hardware would want to do so surreptitiously, but they sure made it as obvious as they possibly could.

Shank

I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.