Plex2Shell: why Plex Media Server users should update now

What is Plex Media Server?

Plex is a popular app that lets people store their own films, TV shows, music and photos on a home computer or network storage box and stream them to TVs and phones. The part that stores and serves the media is called Plex Media Server. Many people leave it running for years, often reachable from the internet so they can watch away from home. That combination of "always on" and "rarely checked" makes it attractive to attackers.

What happened

A security researcher reported four flaws to Plex in late July 2026, and Plex released fixed software in early August. On 16 October full technical details were published, and working attack code followed within days. Security companies saw attacks on test servers almost immediately, at first installing crypto-mining software, which secretly uses the victim's computer to earn money for the criminals.

On 20 October the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities list and told US federal agencies to fix them quickly.

How the attack works, simply

Each flaw on its own is rated medium to high. Chained together, they let an attacker trick the server into revealing its owner's admin access token and then plant a file that the server loads and runs. In plain terms: the attacker ends up in control of the server and can run their own programs on the computer it sits on. The researcher scored the full chain 9.8 out of 10.

Who is affected?

• Anyone running a Plex Media Server version older than 1.43.3.10861.
• The risk is highest if the server is reachable from the internet, which is common for remote streaming.
• Simply using the Plex app on a TV or phone to watch someone else's server is not the issue; the server owner needs to update.

What to do

1. Open the Plex Media Server settings on the computer or storage box where it runs and check the version number.
2. If it is older than 1.43.3.10861, update it now. Turn on automatic updates if available.
3. If your server was out of date and online, look for signs of misuse: very high processor use, fans running loud, unknown programs or scheduled tasks.
4. If you suspect it was taken over, updating is not enough. Back up your media, then reinstall the operating system or reset the storage box, and change your Plex password and any passwords stored on that computer.
5. Consider whether you really need remote access. If not, switch it off.

Tip: Network storage boxes and home servers deserve the same update routine as your laptop. See Keeping your devices updated.

The bigger lesson

The fix had been available for more than two months before attacks began, yet many servers were still exposed. Attackers now move from public details to real attacks in days. Home servers, routers and smart devices are often the forgotten corners of a home network, and they are exactly where criminals look.