Old Plex servers are being hijacked to mine crypto and relay traffic. Update to 1.43.3.10861 or newer

Plex fixed four bugs in Plex Media Server in August. Exploit code for the chain, called Plex2Shell, went public on October 16, and attacks started the next day.

Plex now says the bugs are being “actively and widely exploited” and that any server older than 1.43.3.10861 that is reachable from the internet may already be compromised. Plenty of those servers sit on home connections that people also use for work.

A Plex server you set up years ago and forgot about is now someone else’s crypto miner and proxy, unless it is on 1.43.3.10861 or later.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Attackers are chaining four Plex bugs to take over servers

The Plex2Shell chain links CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex describes them as a server-side request forgery in the player timeline endpoint, access to internal agent functions over loopback, disclosure of the owner’s admin token, and a file write to the Codecs directory. Chained, they let an attacker with no login run code as the Plex process.

The researcher reported the bugs to Plex on July 27, and fixes shipped in 1.43.3.10861 on August 3. Plex told users to update on September 1. The write-up and proof-of-concept were released on October 16, and a honeypot run by a different researcher was exploited on October 17, SecurityWeek reports.

On October 19, Plex posted the CVE list and said it has seen widespread attacks against servers that were not updated.

Any internet-facing Plex server older than 1.43.3.10861

The payloads seen so far are an XMRig-based miner and a program called myawesomeproxy, which routes other people’s traffic through the victim’s connection. The honeypot researcher pointed out that residential IP addresses are useful to attackers for reaching corporate VPNs and email.

Plex servers often run on NAS boxes, where the package manager may lag behind. Plex says those owners may need to install the update by hand. Check the full build number, not just “1.43.3”.

Check the build number in Settings, then look for miners

• In Plex Web, open Settings, then General, and confirm the server is on 1.43.3.10861 or newer.
• On NAS devices, install the package from Plex’s downloads page if the app store has not caught up.
• Turn off Remote Access if nobody uses the server from outside the home or office.
• If the server was older and internet-facing, treat it as compromised: look for the miner and proxy, rebuild from a clean install if you find anything, change the Plex account password and sign out all devices.

Details

• CVE-2026-96652 (SSRF, 5.3), CVE-2026-96654 (URL neutralization in searchOne, 6.9), CVE-2026-96655 (SSRF with owner token, 5.3), CVE-2026-96656 (file name or path control, 8.6). CVSS scores as reported by The Hacker News.
• Affected: Plex Media Server before 1.43.3.10861. Fixed August 3, 2026.
• Observed payloads: XMRig-based miner (mylovelyminer) and myawesomeproxy.

Hunt / verify

• Unknown child processes of Plex Media Server and unfamiliar files in its Codecs directory.
• High, steady CPU use on the Plex host and outbound connections you cannot explain.
• Attack source IPs published by The Hacker News, for example 91.92.40[.]202 and 176.65.139[.]228, in firewall logs. The researcher notes these cover only the honeypot.

Source: Plex security notice; SecurityWeek, October 19, 2026

Sources

• Plex: Important Security Update for Plex Media Server v1.43.2 and earlier
• SecurityWeek: Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
• The Hacker News: Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
• CVE.org: CVE-2026-96656

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].