Plex confirmed on October 19, 2026, that attackers are exploiting four patched Media Server vulnerabilities to install cryptocurrency miners and proxy software. Its updated security notice warns that an older server reachable from the internet may already be compromised. Build 1.43.3.10861 and later are unaffected.
The warning changes the job for owners who missed September's security update: checking the installed version now goes alongside investigating what ran before it was patched. Plex recommends a clean rebuild if compromise cannot be ruled out.
What the attack evidence shows
A honeypot report from BoredHackerBlog describes exploitation followed by malware downloads. The researcher dates the first observed exploitation to October 17. Later updates identify XMRig and a program called myawesomeproxy. The researcher also discloses a collection gap: outbound traffic was initially blocked, so some payloads were missed. That limits the account's completeness, though it supplies direct observations beyond scanning attempts.
Plex's subsequent confirmation describes widespread attacks after a public proof of concept appeared on October 16. Neither that notice nor the honeypot report establishes how many servers were compromised. MrKeyoor has not reproduced the exploit or independently measured its spread.
How an outside request reaches trusted code
The discoverer's October 16 technical disclosure traces a chain through server-side request forgery, internal plugin access, theft of the owner's administrative token and a malicious codec file. A request from outside makes Plex contact its own loopback interface, where internal APIs receive greater trust. Another check mistakes a URL beginning with the loopback address for a trusted destination, allowing the token to leave the server.
With that token, the attacker can manipulate transcoder settings to write a shared library into the Codecs directory. A later transcode loads it and executes its code, according to the disclosure. Execution inherits the Plex process's permissions. Files and mounted storage accessible to that account therefore matter when assessing exposure.
Check the running build, then investigate
Plex directs owners to Settings → General in Plex Web to verify the server version. Its platform instructions also warn that NAS package managers may lag behind the available update, requiring manual installation.
For detection, the researcher's public repository includes a detection directory. Plex's notice adds warning signs such as unexpected processes launched by the server and unfamiliar files in its Codecs folder. These observations warrant investigation rather than a verdict based solely on CPU usage.
The recovery advice extends to signing out all devices and changing the Plex password. Owners also need to consider credentials and shares the service account could access. Watch for further payload analysis in the honeypot report: its proxy finding already expands the investigation beyond unexplained mining activity.