Comment by NelsonMinar

Lots of reports on Reddit about people getting popped. Other payloads too, like a DDOS node.

Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell