A public exploit chain for Plex Media Server is now in active use. According to Gizmodo, attackers hit an exposed test server on 17 October and dropped a crypto miner and residential proxy software, which lets strangers route their traffic through the victim’s home connection. If your Plex server runs a build older than 1.43.3.10861 and is reachable from the internet, we recommend updating it today.
The bugs came from a security researcher who goes by ZM, who published a write-up and proof-of-concept code on 16 October for what he calls Plex2Shell. As SecurityWeek explains, four flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) combine to run code on an exposed server without valid credentials. Gizmodo describes the chain as tricking a server into surrendering its owner’s admin token, then planting a malicious file that runs the next time Plex transcodes a video. The $500 bounty Plex paid ZM drew criticism on X.
Plex shipped the fix well before the exploit went public. Its advisory dates to 1 September and urged all server owners to update, but the attacks show how many servers stayed behind. An anonymous blogger who runs boredhackerblog set up a honeypot on an old Plex build and reported seeing in-the-wild exploitation on the morning of 17 October. The first payload was an XMRig miner, and a proxy tool called myawesomeproxy followed later that day. The tool prints a notice that running it means accepting “the potential external use of your internet traffic”.
The honeypot is the only documented compromise so far. Cyber Security News notes the evidence doesn’t show how many real servers have been hit or who is behind the activity. Gizmodo cites Shadowserver data showing nearly 49,000 hosts still tagged as vulnerable on Saturday, including about 25,100 in North America and about 17,600 in Europe.
Updating isn’t automatic for everyone. Gizmodo reports that Plex’s optional auto-update setting defaults to “Ask me” and only applies to Windows and macOS, so Linux, Docker and NAS installs depend on package managers, container restarts or manual downloads. Cyber Security News adds that Plex’s own notice warned NAS users they might need to install updates by hand. Gizmodo also points out that Plex hasn’t required the update this time, unlike in 2025, when it blocked shared users from connecting to a vulnerable server. As of Sunday afternoon Eastern time, the company hadn’t issued a new statement on the attacks.
How to check your server
Start with the version. Confirm the server itself reports 1.43.3.10861 or later, particularly on Docker and NAS setups where a pulled image or package may not be the build you assume. On Linux, Cyber Security News says the researcher recommends reviewing the Plex process tree with ps axjf for unexpected child processes, suspicious downloads and unfamiliar mining or proxy programs.
Then look at the Codecs folder. In an X post on Sunday, Kraken Chief Security Officer Nick Percoco said the payload sits there and reruns whenever something transcodes, “so killing the miner doesn’t fix it”, as quoted by Gizmodo. If you find a miner, proxy or unfamiliar files, we’d rebuild the server from a clean install after updating and treat the owner account’s credentials as exposed. Where you can, remove router port forwarding to the server.
Does this affect me if Plex only runs on my home network?
The reported attacks targeted an internet-facing server. A server that can’t be reached from outside is less exposed, but we’d still update, since the fix is free and the exploit code is public.
Is killing the crypto miner process enough?
No. According to Percoco, the payload sits in Plex’s Codecs folder and runs again every time something transcodes. A clean rebuild after updating is the safer route.
How do I update Plex on a NAS or in Docker?
Plex’s auto-update setting only covers Windows and macOS. On NAS, Docker and Linux, install the new version through your package manager, a container pull and restart, or a manual download, then confirm the running build is 1.43.3.10861 or later.
