Plex2Shell exploit reportedly used against a Plex server a day after code release

SecurityWeek reports that four Plex Media Server flaws can be chained to run code on an exposed server without valid credentials. A researcher observed exploitation on a vulnerable Plex honeypot on October 17, the day after a write-up and working exploit were released. Attackers deployed a cryptocurrency miner and proxy software. Plex said in September that it had shipped fixes and urged server owners to upgrade.