GoKawiilCISA warns of active exploitation of chained Plex Media Server flaws dubbed Plex2Shell
CISA has issued an alert that attackers are actively exploiting four vulnerabilities in Plex Media Server, collectively named Plex2Shell, which when chained together let an attacker obtain an admin token and execute code with elevated privileges. The flaws were found by researcher Zach Main, disclosed to Plex in July, and published with proof-of-concept code in mid-October, after which exploitation attempts began targeting honeypots to deploy cryptominers. CISA has ordered federal agencies to patch or mitigate affected systems by October 23, with fixes available in Plex Media Server version 1.43.3.10861 and later.