Overview
- A public proof-of-concept published on Oct. 16 triggered observed exploitation the next day that dropped a cryptocurrency miner and a reverse-proxy/backdoor called "myawesomeproxy".
- Plex fixed the underlying chain of four flaws in an August update (build 1.43.3.10861) after researcher Zach Main privately reported them in July and the issues were assigned CVE IDs in September.
- The attack chain uses server-side request forgery and token theft to get an owner admin token and then places an ELF payload into Plex’s Codecs folder so the malware restarts whenever the server transcodes video.
- Scanning by security groups found roughly 49,000 Plex servers still exposed, and many common installs on Linux, Docker, and NAS require manual updates or do not auto-install patches by default.
- Beyond stealing CPU cycles for mining, the backdoor lets attackers route other people’s traffic through victims’ home networks, which can enable proxy abuse, DDoS relay use, and harder-to-detect follow-on intrusions.