A Plex vulnerability is now being exploited in the wild. On October 17, 2026, a security researcher who runs a decoy “honeypot” server reported that attackers used public exploit code against an unpatched Plex Media Server and installed a cryptocurrency miner. The flaws are known as “Plex2Shell”, and Plex released fixes in September. If you run a home media server, here is what the sources say, and what they do not.
How the Plex vulnerability came to light
According to a Plex announcement dated September 1, 2026, the company released Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address a number of security issues, and recommended that everyone update as soon as possible.
A researcher who goes by “zm” then published a write-up on October 16 describing how several bugs can be chained to reach unauthenticated remote code execution, meaning an attacker on the internet could run commands on a server without logging in. The researcher’s timeline says the issue was reported to Plex on July 27, acknowledged on August 4, and given CVE numbers on September 23: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The researcher thanked Plex’s security team for its quick response and fixes. I am not repeating technical exploit steps here.
What attackers did to unpatched Plex servers
The next report came from the author of BoredHackerBlog, who set up a honeypot running a vulnerable Plex version. For weeks it mostly saw scanning and generic attempts. On the morning of October 17, he says, he saw genuine exploitation using the code the original researcher had published.
After he allowed outbound connections, he saw a file download that turned out to be a cryptominer. A later update says the attackers also ran XMRig, a well-known mining program, and a tool called “myawesomeproxy”. When it starts, that program prints a message saying that running it means agreeing to the potential external use of your internet traffic.
What this Plex vulnerability does not tell us
The evidence has limits. It comes from one honeypot, so it does not show how many real servers were hit, and the blogger says his data may be partial because he had to change his settings. He also notes that the CVEs on a public tracker did not carry a CVSS severity score of 9 or higher when published, and that a miner is “not a big deal” for victims compared with other malware. At the same time, he says he would not be surprised if attackers deploy more sophisticated tools later.
It is fair to credit Plex too. It shipped a fix well before public disclosure. The risk falls mainly on people who have not updated, and Plex warned that NAS devices may not yet offer the new version in their package manager, so manual installation may be needed.
What Plex users can do now
Plex’s advice is to run version 1.43.3 or newer on Windows, macOS, Linux, Docker or a NAS, updating manually from its downloads page if automatic updates are off. The researcher’s write-up says Plex is often exposed directly to the internet for remote streaming, so it is also worth checking how your server is reachable.
The security angle matters beyond one app. A miner quietly uses your electricity and processor, and a proxy program could let strangers route traffic through your home connection. Neither source reports theft of personal media or accounts, and I will not suggest otherwise.
My view on the Plex vulnerability
As a writer, I feel there are two lessons here, and neither blames anyone. The researcher who reported the bugs privately and the vendor who fixed them did their part. Yet the gap between a patch and a patched server can last weeks, and exploitation was seen the day after the code went public. In my view the responsibility is shared: vendors should make updates easy, and home users should treat a media server like any other internet-facing computer.
You may also like our stories on open-source vulnerabilities found by Piolink, zero-day patching at Echo Frontier and the cost of data breaches.
FAQ: Plex vulnerability
Which Plex version fixes the vulnerability?
Plex says Plex Media Server 1.43.3 and Plex Desktop 1.115.0 address a number of security issues, and recommends updating to 1.43.3 or newer.
What did attackers install on the honeypot?
According to the researcher who runs it, a cryptominer, later identified as XMRig, and a proxy program called “myawesomeproxy”.
Were real users’ media files or accounts stolen?
Neither source reports that. The evidence comes from one honeypot, not from real users’ servers. If you run an unpatched server, updating now is the safest step.