Plex vulnerabilities exploited to install malware

Patched vulnerabilities in Plex Media Server are now being exploited in attacks that install malware, Ars Technica reports. An exploit chain called Plex2Shell combines several vulnerabilities to enable remote code execution on a device running a vulnerable version.

After the technical details were published, another researcher deployed a honeypot server to observe exploitation attempts. He detected scans, followed by successful infections. The observed payloads include cryptocurrency mining software that benefits the attacker and residential proxy software, which allows traffic to be routed through the compromised machine.

For users, the priority is to check for available updates. Ars Technica recommends updating older versions immediately. The software supports automatic updates; manual installation is also possible. The outlet also advises limiting the server's exposure to the Internet, noting that restricting access to the local network reduces some functionality.

The researcher behind the chain says he used AI extensively during his work, while retaining control over decisions about which avenues to explore. This account describes assistance with vulnerability research. It does not establish that the observed attacks can be attributed to an autonomous system or allow any general effect of AI on their frequency to be measured.