AGTP on X: "Plex Media Servers are being hijacked by unauthenticated attackers, and ...

Plex Media Servers are being hijacked by unauthenticated attackers, and exploit code is public. Here's what you need to know.

International Cyber Digest reports attackers are taking over Plex Media Servers with no login needed. A researcher says an internet-facing Plex honeypot was compromised on October 17. It was turned into a crypto miner and a proxy.

The attack is a chain of four recently disclosed vulnerabilities, nicknamed Plex2Shell. Together they give unauthenticated remote code execution. Exploit code was published on GitHub on October 16, and exploitation in the wild began right after. The researcher's honeypot mostly saw scanning until the 17th, then got hit.

The payloads were XMRig, a Monero miner, and a proxy tool that routes traffic through the victim's IP. The four CVEs being cited are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.

The catch is that the honeypot ran a known vulnerable, outdated Plex version. Plex already fixed these bugs in Plex Media Server 1.43.3, released in early September. Up-to-date servers are not affected. Plex's advisory covers version 1.43.2 and earlier. One report earlier in September counted more than 36,000 Plex servers exposed to the internet.

- 36,000+ exposed Plex servers reported in September

Security folks say update Plex now and keep it off the open internet unless you truly need remote access. Others suggest running media apps as low-privilege users or in containers.

‼️ BREAKING: Unauthenticated attackers are hijacking Plex Media Servers.

Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.

A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.