OTX Threat: Plex vulnerabilities being exploited in the wild to drop a cryptominer

Multiple Plex Media Server vulnerabilities announced in September 2026 are being actively exploited to deploy cryptominers and proxy software. The exploitation chains together four CVEs to achieve remote code execution on vulnerable Plex servers. A honeypot deployment captured exploitation attempts from multiple IP addresses starting October 17, 2026. Attackers deployed XMRig cryptominer and myawe CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656