Hunt: Plex2Shell implants in the Plex Codecs folder
Two untested draft Sigma rules for Plex2Shell on Linux: shared objects written to Plex's Codecs folder, and Plex spawning shells, downloaders or known miners.
Plex Media Server
Plex2Shell is being exploited: patch Plex, then assume compromise
A four-bug Plex Media Server chain is planting miners. The fix shipped in August; exposed servers older than 1.43.3.10861 should be treated as compromised.
