Plex2Shell: Plex Media Server Under Attack, Update Now

Last updated: 24 October 2026. Sources are listed at the end.

Attackers are breaking into home and small-office media servers through a chain of bugs called Plex2Shell. Plex fixed the flaws in August, but tens of thousands of Plex Media Server installs never got the update. On 20 October, CISA added four of the bugs to its list of actively exploited vulnerabilities. If you run Plex, this Plex2Shell guide shows how to check your version, update and look for signs of a break-in.

The short answer

• Update Plex Media Server to 1.43.3.10861 or later. Current releases are 1.43.5.x.
• Turn off Remote Access if you don’t need to stream from outside your home.
• Never forward port 32400 straight to the internet.

What is Plex2Shell?

Plex2Shell chains four bugs into full remote code execution, with no login and no user action. The researcher who found it rates the chain 9.8 (Critical).

The root problem is simple: the server only checked that an X-Plex-Token header existed, not that it was valid. From there, the chain steals an admin token and plants a shared library that runs as the plex user.

Plex2Shell timeline

• 27 July: the researcher reports the bugs to Plex.
• 3 August: Plex fixes them in version 1.43.3.10861.
• Early September: Plex emails owners to update. Even so, more than 36,000 exposed servers were still unpatched that month.
• 16 October: full details and exploit code go public.
• 17 October: attackers hit a honeypot within a day.
• 20 October: CISA adds four CVEs to its Known Exploited Vulnerabilities catalog.

What attackers are doing

So far, attackers install cryptominers (XMRig) and proxy malware that rents out your internet connection. Social posts claim that attackers are stealing personal files and streams. We found no report of data theft yet. However, the attacker can run any command as the Plex user, which normally can read your whole media library. So treat any compromise as serious.

Step 1: Check your Plex version

In the Plex web app, open Settings → General; the version appears there. On a Linux server, you can also check from the terminal:

# Debian/Ubuntu package
dpkg -s plexmediaserver | grep -i '^version'

# RHEL/Fedora package
rpm -q plexmediaserver

# Docker: which image is the container running?
docker inspect --format '{{.Config.Image}}' plex

Anything below 1.43.3.10861 is vulnerable. For Docker, the official plexinc/pms-docker image had 1.43.5 tags by 20 October.

Step 2: Update

• Windows and macOS: use the update button in the Plex web app, or download the latest installer.
• Linux: update through the Plex repository with apt or dnf, or install the latest package from the Plex downloads page.
• Docker: pull a current image and recreate the container.
• NAS (Synology, QNAP and others): update the Plex package in the NAS package centre.

After the update, restart the server and confirm the new version in Settings → General.

Step 3: Reduce exposure

1. Disable Remote Access in Settings → Remote Access if you only watch at home.
2. Remove manual port forwarding for 32400 on your router. Also turn off UPnP if you don’t need it.
3. If you do need remote streaming, put the server behind a VPN such as WireGuard or Tailscale instead.

Step 4: Look for signs of compromise

Researchers have published these indicators:

• Files: x12345, mylovelyminer (miner) and myawesomeproxy (backdoor and proxy)
• Unknown files in the Codecs folder, especially recently added .so files on Linux
• Domains: ota.proxystream[.]st and global.relay.proxystream[.]st
• IP addresses: 217.60.194[.]116, 91.92.40[.]202, 176.65.139[.]228 and 45.194.92[.]222
• High CPU use when nothing is playing

On Linux, these commands help:

# Processes run by the plex user that aren't Plex itself
ps -u plex -o pid,etime,cmd | grep -viE 'plex|PID'

# Files with the known malware names
sudo find / -xdev \( -name 'mylovelyminer' -o -name 'myawesomeproxy' -o -name 'x12345' \) 2>/dev/null

# Recently changed files in the Plex Codecs folder (Debian/Ubuntu default path)
sudo find '/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs' -newermt '2026-10-16' -ls

If you find anything, disconnect the machine, back up your media library and reinstall the operating system from a clean image. Afterwards, change your Plex password and sign out all devices in your Plex account.

Quick checklist

• ☐ Plex Media Server on 1.43.3.10861 or later
• ☐ Remote Access off, or behind a VPN
• ☐ Port 32400 not forwarded on the router
• ☐ Checked for unknown processes, files and high CPU
• ☐ Plex password changed if anything looked wrong

Home servers and NAS boxes are easy to forget. For a wider check, our free Linux server hardening checklist covers updates, firewalls and exposed ports. For other attacks from the same month, see our Black October fact-check.

Sources

• Researcher write-up: Plex2Shell
• The Hacker News: hackers exploit Plex2Shell flaws
• The Hacker News: CISA orders agencies to patch
• Plex forum: Plex Media Server release notes
• BleepingComputer: over 36,000 Plex servers unpatched

Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.