PLEX VULNERABILITIES BEING EXPLOITED IN THE WILD TO DROP A CRYPTOMINER

Summary from the TLDR InfoSec newsletter

A honeypot running Plex Media Server 1.43.2 observed live exploitation on October 17. Attackers chained CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 to obtain remote code execution, then downloaded a cryptominer and a proxy component. The observed source IPs were 45.194.92[.]222, 91.92.40[.]202, and 176.65.139[.]228, and the payload host was 217.60.194[.]116.