Plex2shell Home Servers Crypto Miner

Plex servers, more than 36,000 of them, sat open to the internet. A day after the attack code went public, some were mining crypto for an outsider. The owners did nothing wrong.

Plex is the app a lot of people use to keep their films, series and music in one place. You watch it on a TV, a phone or a laptop. It runs on a home PC, on a network drive in the hallway, or in a small container on a server somewhere in the house. To reach your library when you are away, Plex listens on port 32400. Many owners leave that port open to the internet, so the app keeps working on the train or at a friend’s place.

That open door is the problem. On October 16, a researcher who goes by ZM put out a full write-up and working attack code for four bugs in Plex Media Server. The attack had a name, Plex2Shell. One day later, on October 17, the first server fell.

An outsider sends a request to a Plex server that faces the internet. No login needed. That request reaches a part of the server meant only for the machine itself. From there, the attacker gets Plex to hand over the owner’s admin token, the secret string that says you are the one in charge. With that token, the attacker writes a file into the folder where Plex keeps the small programs it uses to convert video. Plex then loads that file and runs it. At the end, someone who never had an account is running code on your machine, with the same rights as Plex.

The four holes each got a tracking number: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex later spelled out what each one does. The first lets an outsider send that opening request without logging in, through the part of Plex that follows what your player is doing. The second opens a path to functions Plex keeps for the machine itself. The third leaks the owner’s admin token. That one rests on a small mistake: Plex only checks that a web address starts with its own 127.0.0.1, the machine itself, so an address like 127.0.0.1.evil.com passes the check, and the token goes to the attacker instead.

The fourth step lets the attacker write a file into the Codecs folder, where Plex loads it as if it put it there. On their own, none of these four holes looks like much. Lined up in the right order, they add up to full remote control of a box in your living room.

ZM reported all four bugs to Plex on July 27. The fixed build, 1.43.3.10861, went out on August 3, and Plex confirmed the bugs and paid a bounty on August 4. Then it went quiet. Not until September 1 did Plex post a short notice on its forum, pointing people to Plex Media Server 1.43.3 and Plex Desktop 1.115.0 for some security issues, with a line asking owners to update soon. It did not say what the issues were. The tracking numbers were still being requested.

So for six weeks, an owner knew only that there were “some security issues” and that they should update. People outside Plex and the researcher had no idea how bad it was. The tracking numbers arrived on September 23. The full write-up and the attack code landed on October 16. The attacks began on October 17.

A researcher who runs decoy machines had set up an old, vulnerable Plex server on purpose, to watch what would come. For days it drew only the usual background noise of the internet, scanners knocking on doors to see which ones answer. On October 17 that changed. Attackers took the decoy over and dropped two things onto it.

The first was a cryptocurrency miner called XMRig. A miner runs your processor flat out, day and night, solving math problems that earn digital coins. You pay the power bill and your machine runs hot and loud, and the coins go to whoever installed it. The second was a small program the attackers named myawesomeproxy. A proxy passes other people’s internet traffic through your connection, so their activity looks like it came from your home address. Your line gets rented out without a word.

When your address sits in the logs, you take the blame for it. A website blocks you, a scan gets traced back to your house, or an officer turns up at your door with questions. The researcher who ran the decoy saw its traffic reaching out to a known proxy service, the kind that resells access to home connections like yours.

The proxy also gives away who these people are. When it starts, it prints a line of text. It reads: “Running this software on any of your devices makes you agree to the potential external use of your internet traffic.” The owner of the machine never saw it and never agreed to a thing. The attacker wrote that line.

On October 19, Plex updated its forum post and dropped the careful wording. “These vulnerabilities are being actively and widely exploited,” it wrote, and it confirmed that broken-in servers were being used for mining and proxy traffic. Then came a blunt instruction: “If your server is older than 1.43.3.10861 and reachable from the internet, assume it may be compromised.”

How many servers is that? After the September notice, the Shadowserver Foundation, a non-profit that scans the internet for exposed systems, began counting. Within days it had found more than 36,000 Plex servers still on the vulnerable versions and reachable from outside, with the United States well in front. And that is only the servers still out of date. Shadowserver puts the number of Plex servers reachable from the open internet at close to 300,000.

This is a pattern. A fix can sit in the open for weeks while little happens. Then the working attack code goes public, and within hours the quiet scanning turns into break-ins. The servers that had stayed safe only because the exploit was private were now in reach once the code was public. Ten weeks of calm, and then one loud day. That is why a public proof of concept is treated as the start of the clock.

The people most at risk set Plex up once and left it running. On Windows and a Mac, the app can update itself, but only if you turned that on. By default it only asks, and that prompt is easy to miss. On a network drive or inside a container, it does not update at all. Those owners get no new version until they go in and pull it down by hand, and a server that quietly does its job for years is one an owner rarely opens to check.

One detail makes Plex’s handling worse, and you see it only when you look back a year. In 2025, a different bug turned up in Plex. The company emailed the owners and told them to update to version 1.42.1. Weeks later, with a lot of servers still not updated, Plex did something firm. It blocked other people from connecting to any server still on an affected version. In its words, “other users to which the server owner has granted access to the server will not be able to connect to it while the server is running an affected version.” Shared access came back once you updated. It was annoying, and it worked, because a feature that breaks until you fix it gets fixed.

This time, Plex did none of that. It did not force the update, and it left old servers reachable. The notice went out, the attack code went public six weeks later, and the servers that had not been touched were still open, waiting.

This is not the first time an unpatched Plex server at home became a way into something far bigger. The 2022 break-in at the password manager LastPass began on the home computer of one of its engineers. LastPass itself only called it outdated third-party software. Plex later confirmed it was Plex: an old version, dozens of releases behind, running a 2020 bug it had already fixed, still open because the engineer never updated. A media server in a spare room is a full computer on your network. When it faces the internet and runs old code, it is a way in.

If you run Plex, here is what to do.

• → Check your version. In Plex, open Settings, then General, and read the version number. Anything below 1.43.3.10861 is vulnerable.
• → Update to 1.43.3.10861 or later. On Windows and macOS the app can update itself. On a network drive or inside a container it usually will not, so you pull the new package or image by hand.
• → Keep port 32400 off the open internet unless you truly need remote access. If you only watch at home, that door can stay shut.
• → If your server was out of date and reachable from outside, treat it as possibly broken into. Watch for Plex working the processor hard when no film is playing, for unknown files in the Codecs folder, and for programs you did not start.

Anything with a plug and a network cable is a computer. A media server, a router, a camera, a TV box, they all sit there listening. Forget about one, leave it on an old version facing the internet, and someone else will find it before you do. Attackers scan for the ones that still answer.

Want to see what your own home network shows to the outside, including whether your Plex port is open? Scan it from outside with Nmap and read which ports answer back. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Plex2Shell write-up (ZM) | Plex security advisory