Plex vulnerabilities being exploited in the wild to drop a cryptominer

Plex Media Server vulnerabilities (CVE-2026-96652, 96654, 96655, 96656) are being actively exploited in the wild to deploy cryptominers, following the publication of exploit code on October 16, 2026. Security researchers have documented in-the-wild exploitation attempts using chained vulnerabilities to achieve remote code execution, with attackers scanning for vulnerable Plex instances and attempting to deploy malware payloads. While current attacks focus on cryptocurrency mining, researchers warn that threat actors could potentially leverage compromised residential Plex installations to gain proxy access to corporate networks and systems.