Hunt for Plex2Shell (CVE-2026-96652/96654/96655/96656) exploitation of Plex Media Server: /player/timeline requests with a loopback protocol= URL, 127.0.0.1.*.sslip.io callbacks, TranscoderH264Options dump-yuv, unexpected .so/.dll files in Codecs, plus honeypot IOCs (4 IPs, XMRig and proxy hashes) from Oct 17, 2026.

Context: Plex2Shell alert. IOCs come from one researcher's honeypot (BoredHackerBlog, Oct 17-18, 2026). They are a starting point, not a full list, and the exploit's ports, hostnames and file names are easy to change.

IOCs (honeypot, Oct 17, 2026)

• 45.194.92.222: exploitation source (also observed downloading payloads)
• 91.92.40.202: exploitation source
• 176.65.139.228: exploitation source
• 217.60.194.116: payload download host (files "docker" and "x")

SHA-256:

• 5712ef510481f15fe8b18fdd10b73026d57cb3d9d151878a692358b99a464441: docker (dropper)
• 68938fb428f2bcfef4ede62f7b29cd0f15f37ed59e94462c099f2ca64e36baa7: x (UPX-packed miner)
• b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49: x (unpacked)
• 2d3c618b21a7e2f8bcd735da188e44a7609ff3f204832dd0781cd09e4388c9db: xmrig
• e546b10aee5edc754da4f9b0baace00392257121911f630145078eafad1e6bd9: myawesomeproxy (residential proxyware)

The researcher's sandbox runs of the proxy tool show traffic related to proxystream.st. Pcaps and samples: BoredHackerBlog/plex2shell_pcap.

Network detections (web/proxy/Zeek logs for TCP 32400)

1. GET /player/timeline/subscribe or /player/timeline/* where protocol= holds a full URL, especially http://127.0.0.1:32400/system/agents/ (the CVE-2026-96652 SSRF into CVE-2026-96654).
2. identifier= values containing /function/GetResultFromNetwork, or URL-encoded ?/# (%3F, %23), in searchOne requests.
3. DNS lookups or outbound HTTP from the Plex host to names starting 127.0.0.1. under sslip.io (or nip.io-style services). This is the owner-token theft step. The PoC defaults to ports 8952 (token), 8933 (carrier) and 9001 (reverse shell).
4. PUT /:/prefs setting TranscoderH264Options, and /video/:/transcode/universal?path=http pointing at an external host.
5. Low-signal hints: User-Agent: Python-urllib/* and client identifiers starting poc_ in the honeypot traffic.

Host detections

1. Preferences.xml: any TranscoderH264Options containing dump-yuv or stats=.
2. Files in Plex Media Server/Codecs/<set-id>-<platform>/ that don't match Plex's codec set (new .so/.dll, recent modification times, odd size or padding). A loaded file shows up as (deleted) under /Codecs/ in /proc/<pid>/maps.
3. Child processes of Plex Transcoder or Plex Media Server that are shells, curl/wget, xmrig, or binaries in /tmp; /dev/tcp in command lines; sustained CPU on the Plex user.
4. The researcher's read-only hunt script and YARA rules check for the items above (version, prefs, logs, Codecs, live processes). Read them before use; run them only on hosts you own.

# quick Linux triage (read-only)
grep -o 'TranscoderH264Options="[^"]*"' "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Preferences.xml"
find "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs" -type f -newermt 2026-10-15 -ls
ps -u plex -o pid,ppid,%cpu,etime,cmd --sort=-%cpu | head
sudo ss -tnp | grep -v -E 'Plex (Media Server|Transcoder|Relay)' 

Docker paths: the config sits under the host volume mapped to /config, at Library/Application Support/Plex Media Server.