NewsCompaniesFlawsGuides
Get the app

Plex Media Server under attack: update to 1.43.3.10861 or newer now

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Attackers are chaining four flaws in Plex Media Server to take over servers without logging in. They install crypto miners and proxy software that sends strangers' internet traffic out through the owner's home connection. Plex says the attacks are active and widespread, and CISA added all four flaws to its list of exploited flaws on 20 October. The fix has been out since early August.

Four flaws in Plex Media Server are being used to break into home media servers and put them to work for strangers. The fix has been out since August, but tens of thousands of servers never installed it.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If someone in your family keeps a film and TV library on a home server, it probably runs Plex, the app that streams it to the TV, the iPad and the phone. Since 17 October, attackers have been breaking into those servers using four flaws a researcher published in mid-October. Plex calls the flaws "actively and widely exploited", and on 20 October the US cybersecurity agency, CISA, added all four to its list of flaws known to be used in attacks.[1][2]

The fix isn't new. Plex released Plex Media Server 1.43.3.10861 in early August and warned owners to update on 1 September. Many didn't. In September, Shadowserver, a non-profit that scans the internet, counted more than 36,000 exposed Plex servers[3] still on older versions. Once the full details went public, the first attacks followed within a day[4].

Timeline

  1. Plex releases Plex Media Server 1.43.3.10861, the fix.[4]

  2. Plex warns owners to update.[1][5]

  3. Shadowserver counts more than 36,000 exposed Plex servers still on older versions.[3]

  4. A researcher publishes the full details of the four flaws.[4]

  5. The first attacks: servers taken over to mine cryptocurrency and to run proxy software.[4][6]

  6. CISA adds all four flaws to its list of flaws known to be used in attacks. Plex calls them “actively and widely exploited”.[2][1]

  7. HARD publishes its article, at Critical.

What the attackers do

Each flaw on its own is a modest problem. Researchers call the four together Plex2Shell. The first lets anyone on the internet make the server send web requests, no account needed. Through the second and third, the attacker gets the server to give up the owner's admin key. With that key, the fourth lets them plant a file that Plex then runs as if it were its own. At that point the server is theirs.

So far, attackers have done two things with the servers they take. One is cryptocurrency mining, which uses your electricity and slows the server down. The other is worse: proxy software, which lets strangers send their internet traffic out through your home connection. Whatever they do online appears to come from your home internet address.

Why a media server matters

A Plex server isn't somewhere out on the internet. It sits on the home network, next to the family laptops, the storage box with the photos and tax returns, and the cameras. Two of the flaws make it send requests wherever an attacker points it. The official description of one says those can include internal addresses: other devices on the same network.

Plex hasn't said attackers have moved from a Plex server onto other devices in a home, and the reports so far describe miners and proxies. But someone who can run software on a computer inside your house has a starting point, and the Plex password is often reused elsewhere.

A home media server is a computer inside your house that strangers can reach.

Who is affected

Anyone who runs a Plex Media Server, whether it's on a storage box in the cupboard, an old PC, a Mac or a gaming computer. Teenagers and whoever looks after the house's tech are the most likely to have set one up, so ask. If you only watch Plex on a server someone else runs, there's nothing for you to install, but the person who runs it needs to update.

The version matters. "1.43.3" alone isn't enough: Plex released 1.43.3.10828 in July, and it's still vulnerable. You need build 10861 or later. Field Effect, a security firm, says servers that can only be reached inside the home can still be attacked from that same network, so update even if Remote Access is off. If a server ran an older version and could be reached from the internet in the past fortnight, assume it may have been taken over.

How this reaches a family

  1. An old Plex server, open to the internetIt was set up years ago so the family could watch from anywhere. It hasn’t been updated since.
  2. HARDUpdates ranked, and every app’s trafficHARD ranks updates by whether attackers are using the flaw, so this one comes first, and on a Mac it shows every app’s connections. On HARD Engineer, your engineer checks what in each home can be reached from the internet.See how it works
  3. Someone else takes it overAttackers use the flaw to run their own software on it.
  4. Your connection works for themIt mines crypto on your power bill and sells your home internet to strangers, whose traffic looks like yours.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What to do this week

  1. Find every Plex server in the family.Your own, the kids', and any set up for parents or at a holiday house. Check the full version number in the server's settings.
  2. Update to 1.43.3.10861 or newer.Update from the server's own settings or from Plex's downloads page. On a storage box (a NAS), the update can reach its app store late. If it isn't there yet, Plex suggests installing it by hand. Update the Plex Desktop app to 1.115.0 or newer too.
  3. Turn off Remote Access if nobody uses it.Plex's advice: if you don't watch from outside the house, switch it off under Settings, then Remote Access. Don't leave port 32400 open on the router unless you need it.
  4. Look for signs of a break-in.Plex lists programs you don't recognise, unfamiliar files in the Plex Codecs folder and unusual connections out to the internet. In plain terms: a server that's working hard, with fans running, when nobody's watching anything, or home internet that's slower than usual.
  5. If in doubt, start clean.Plex says that if you can't rule out a break-in, reinstall the server from scratch, sign out of all devices in your Plex account settings and change your Plex password. If that password is used anywhere else, change it there too.
  6. Ignore "Plex security" emails with links. News like this brings fake alerts. Go to Plex yourself rather than clicking.

Or have someone do it. Knowing what's running in the house, and patching it before strangers find it, is part of what private cybersecurity is for.

  • CVE-2026-96652 Attackers can make Plex Media Server send requests into the network behind it.
  • CVE-2026-96654 Attackers are using a flaw in Plex Media Server.
  • CVE-2026-96655 Attackers can make Plex Media Server send requests into the network behind it.
  • CVE-2026-96656 Attackers are using a flaw in Plex Media Server.
  • Plex every Plex flaw being used in attacks

References

  1. ^ Plex (). “Important security update for Plex Media Server v1.43.2 and earlier”. Vendor advisory (first posted 1 Sept, updated 19 Oct): the four CVEs, fixed version, active exploitation, miners and proxies, clean-up and Remote Access advice.
  2. ^ CISA (). “Known Exploited Vulnerabilities Catalog”. All four flaws added 20 Oct; due dates 23 Oct and 3 Nov; ransomware use unknown.
  3. ^ BleepingComputer (). “Over 36,000 Plex servers unpatched against recently disclosed flaws”. Shadowserver count of more than 36,000 exposed unpatched servers in September.
  4. ^ BleepingComputer (). “CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers”. Timeline: details published 16 Oct, attacks from 17 Oct; unauthenticated first step; fix released early August.
  5. ^ BleepingComputer (). “Plex warns users to patch security vulnerabilities immediately”. Plex emailed owners; advice to install manually on NAS if the package lags.
  6. ^ Field Effect (). “Active exploitation of Plex2Shell vulnerabilities”. Exploitation from 17 Oct; proxy malware relays third-party traffic; port 32400 exposure; internal-only servers still exploitable from the same network.
  7. Plex (). “Plex Media Server release notes (1.43.3.10828)”. Shows an earlier 1.43.3 build (10828) released in July, below the fixed build.
  8. NIST NVD. “CVE-2026-96655”. Official description: authenticated user can make the server request arbitrary internal or external addresses; fixed before 1.43.3.10861.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.