Last updated: October 20, 2026
The quick answer
Exploit code for a set of Plex Media Server flaws nicknamed “Plex2Shell” went public on October 16, and a researcher’s internet-facing test server was taken over the next day and loaded with a cryptocurrency miner and a proxy tool. Plex fixed the problems in version 1.43.3 back in August, so anyone running an older server should update right away and, if remote access isn’t needed, switch it off.
What happened
Plex Media Server is the software many people run on a home PC or NAS to stream their own movies, shows and music to TVs and phones. In late July, security researcher Zach Main privately reported a chain of four vulnerabilities to Plex (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). Plex shipped a fixed release in early August and, around September 1, emailed server owners and posted a notice urging everyone on version 1.43.2 or earlier to update.
Many didn’t. Cord Cutters News reports that earlier assessments found more than 36,000 internet-facing Plex servers still unpatched in September. Once proof-of-concept code was published on October 16, the window closed fast: a honeypot server set up by a researcher was compromised on October 17. The attackers installed an XMRig-based miner, which quietly burns your computer’s processor to generate cryptocurrency, plus a proxy tool that routes other people’s internet traffic through your home connection.
Chained together, the flaws let an attacker who can reach the server steal the owner’s admin token and plant malicious files in Plex’s Codecs folder, which then run when the server transcodes video. No Plex login is needed. So far only that single controlled honeypot has been confirmed as hit, and there is no count of real victims, but Plex users on community forums have reported seeing attacks.
| Software | Vulnerable | Fixed |
|---|---|---|
| Plex Media Server | Versions before 1.43.3 (including 1.43.2 and earlier) | 1.43.3 or newer (reports cite build 1.43.3.10861) |
| Plex Desktop app | Older versions | 1.115.0 or newer, per Plex staff |
What changes for you
If your server is current, nothing changes. If it isn’t, the risk is no longer theoretical: working attack code is freely available and automated scanning for exposed servers is cheap. A hijacked server can slow your machine, raise your electricity bill, and make your home IP address look like the source of someone else’s traffic. Because the malicious files sit in the Codecs folder, they can also survive and rerun later unless removed.
Servers reachable from the internet, usually because Remote Access is turned on or port 32400 is forwarded on the router, face by far the highest risk. Servers used only inside your home network are much less exposed, but should still be updated.
What to do now
- Check your version. Open the Plex web app, go to Settings and look at the server’s General page, which shows the installed version. Anything below 1.43.3 needs updating.
- Update the server. Download the latest release from Plex or use the update prompt in the web app. NAS owners: Plex staff note that your package manager may lag behind, so install the update manually if it isn’t offered yet.
- Update Plex Desktop too to 1.115.0 or later if you use it.
- Turn on automatic updates where your platform supports it, so the next fix lands without you having to remember.
- Reduce exposure. If you don’t stream away from home, disable Remote Access and remove any port forwarding for 32400 on your router. If you do need it, consider a VPN to your home network instead of an open port.
- Look for warning signs. Sustained high CPU use when nothing is playing, unfamiliar files in Plex’s Codecs folder, or processes started by Plex with names like myawesomeproxy, mylovelyminer or x12345 all point to a compromise.
- If you find something, rebuild. Security researchers consider reinstalling from a clean base the most reliable recovery. Afterwards, change your Plex account password and review which devices and users have access.
While you’re tightening up your home network, also read our guide to the Broadcom Wi-Fi router flaw, which affects some ISP-supplied gateways.
Who is affected, and who isn’t
At risk: anyone running a Plex Media Server older than 1.43.3, especially with Remote Access on or a forwarded port. Older NAS installs that rely on a vendor package center are a common blind spot.
Not directly affected: people who only watch through Plex apps on a TV, phone or streaming stick and don’t host their own server, and server owners already on 1.43.3 or newer. If you use a friend’s shared library, the server owner is the one who needs to update.
FAQ
Does an attacker need my Plex password?
No. The chain works without logging in, as long as the attacker can reach the server over the network. That is why internet exposure matters so much.
I updated in August. Am I safe?
If you’re on 1.43.3 or newer, you have the fix. It’s still worth a quick check for odd CPU use or unknown Codecs files if the server was exposed before you updated.
Has Plex commented on the new attacks?
Plex’s earlier notice asked all server owners to update “as soon as possible.” Reports so far haven’t cited a new Plex statement about the October exploitation.
Leave a Reply