Your Movie Night Can Wait: Update Plex Now

Plex Media Server is popular because it makes a collection of films, music, and photos feel like a private streaming service. It can run on a dedicated server, a virtual machine, a NAS, a Docker host, or a small home appliance that quietly lives next to the router.

That last part can make Plex easy to forget. It is not just a television accessory, however. It is a network service, often reachable from the internet, with access to storage and other parts of the home or office network. Right now, outdated Plex servers are being actively attacked.

A chain of vulnerabilities known as Plex2Shell allows an unauthenticated attacker to run code on a vulnerable Plex Media Server. Attackers have already used it to install cryptocurrency miners and proxy software. In other words, somebody else may use your electricity, CPU, internet connection, and IP address. They will probably not contribute to the subscription budget.

The short version is simple: update Plex Media Server immediately.

The fix has been available for a while

The Plex2Shell chain combines four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Their individual mechanics are interesting to security researchers, but server owners mainly need to know the result: together, they allow remote code execution without a valid Plex login.

The vulnerabilities were reported privately to Plex in July. Plex released the corrected server version in August and published a security notice in September, before full technical details and working exploit code became public.

That public proof of concept appeared on October 16. Exploitation was observed in the wild the following day. In an update to its security notice, Plex confirmed that attacks against unpatched internet-facing servers are active and widespread.

Plex Media Server 1.43.3.10861 and later are not affected by this vulnerability chain. Do not stop at the minimum version if a newer stable release is available - install the current release for your platform.

Check the server, not just the television app

Updating the Plex app on a smart TV or phone does not update Plex Media Server. The server is the system that stores or indexes the library and streams content to those apps.

Open Plex Web, select the server, and go to Settings > General. Check the Plex Media Server version shown there. If it is older than 1.43.3.10861, update it now.

The installation method depends on where the server runs:

• On Windows or macOS, use the built-in update prompt or download the latest release from the official Plex downloads page.
• On a supported Linux distribution, update through the configured Plex repository or install the current package supplied by Plex.
• For Docker, pull the latest official image and recreate the container, then verify the version inside Plex Web. Restarting an old container does not make its image younger.
• On a NAS, check the vendor’s package manager, but verify the actual Plex version afterwards. NAS repositories sometimes receive updates later. Plex specifically notes that users may need to download the correct package and install it manually through the NAS interface.
• On NVIDIA Shield, install all pending Plex Media Server updates through Google Play.

Do not assume that automatic updates worked. The version number is the useful answer; the checked box is only an intention.

A NAS is not exempt because it lives at home

Many affected systems are not traditional public servers. They are home NAS devices with Plex Remote Access enabled or TCP port 32400 forwarded through the router.

From an attacker’s perspective, the label on the box does not matter. A NAS can hold family photos, backups, documents, and credentials alongside the media library. If Plex is compromised, the attacker receives the permissions of the Plex service and may be able to reach mounted shares or other data available to that account.

The same applies to a mini PC, an old desktop, or a pre-built media appliance. “It only runs movies” is a description of what the owner intended, not a security boundary.

If you do not use remote access, disable it under Settings > Remote Access and remove the port-forwarding rule from the router. This reduces exposure, but it does not replace the update.

What if the server was exposed while vulnerable?

Plex’s own guidance is direct: if a server older than 1.43.3.10861 was reachable from the internet, assume it may have been compromised.

Installing the update closes the vulnerability, but it does not remove a miner, proxy, or other payload that an attacker may already have installed.

Warning signs observed in current attacks include unexplained high CPU or network use, unfamiliar processes started by Plex, unexpected files in the Plex Codecs directory, and connections to unknown external systems. Known malicious process names include myawesomeproxy, mylovelyminer, and x12345, but their absence proves very little. Attackers can change filenames much faster than articles can list them.

If you find suspicious activity or cannot confidently rule out compromise:

1. Disconnect or isolate the server from untrusted networks.
2. Preserve relevant logs if you need to investigate what happened.
3. Rebuild Plex from a clean installation without reusing the old Plex data directory.
4. Sign out all devices from the Plex account and change the Plex password.
5. Review mounted shares, stored credentials, and other systems the Plex service could access.
6. Rotate any credentials that may have been available to the compromised host.

Copying an entire compromised installation into a clean operating system can also copy the problem. Recover media and other necessary data only from sources you trust.

This update should not wait for the weekend

Plex2Shell is no longer a theoretical risk or a bug waiting patiently for a maintenance weekend. Working exploit code is public, and real servers are already being used for mining and proxy traffic.

Check every Plex Media Server you operate, including the forgotten one on a NAS at a relative’s house. Update it to the newest available release, confirm the installed version, and disable unnecessary internet exposure. If an old version was publicly reachable, inspect it and be prepared to rebuild it.

The library scan can finish later. The security update should not.