Attackers began exploiting Plex2Shell, a chain of four flaws in Plex Media Server, a day after technical details and working exploit code were published on 16 October. The flaws allow code execution on an exposed server without credentials. Plex had already shipped fixes in September. On a researcher's honeypot, attackers installed a cryptocurrency miner and proxy software.

What it means: The story repeats a familiar pattern: a fix has been available for weeks, yet many servers stay unpatched and become targets as soon as ready-made attack code appears. The window between publication and mass exploitation has now shrunk to hours. The use of compromised machines as proxies is especially notable. Many Plex servers run on home connections, and a residential IP address is valuable to attackers who want to reach corporate VPNs or email without raising suspicion. That means a personal media system can become a bridge for attacks on businesses. For people in Greece who work from home and keep similar servers or NAS devices exposed online, the advice is simple: update at once, avoid direct internet exposure and check for unknown processes. Companies should also look closely at logins coming from residential addresses that behave unusually. The case is also a reminder that automatic updates are worth switching on wherever possible. Waiting for a convenient moment can leave a device open for weeks.

Read the original on SecurityWeek

Related service: Custom software

Related stories