Plex servers exposed to attacks

Users install Plex to access their movie collection remotely. For this, they open a port on their box and then forget about it. This small server remains permanently reachable from the Internet, and hackers scan open ports in search of forgotten machines.

Plex warns of critical security update

On September 1st, 2026, Plex requested all server owners to upgrade to version 1.43.3 through an alert on its forum and a direct email. The publisher had already done so in August 2025 for the vulnerability CVE-2025-34158.

Multiple security flaws discovered

Four identifiers were assigned on September 23: CVE-2026-96652, 96654, 96655, and 96656. The researcher Zach Main had reported these vulnerabilities to Plex as early as July 27, in exchange for a reward of $500 (approximately 430 euros).

Attack details revealed

This Friday, October 16, he published his full analysis and a demonstration code. The following day, another researcher saw his honeypot, a fake Plex server left exposed, attacked with this code. Early September, the Shadowserver Foundation had already recorded more than 36,000 exposed and unpatched Plex servers.

Exploitation requires no credentials

Four consecutive vulnerabilities, no password required. The attack does not require any valid credentials: it is sufficient for the server to be reachable on port 32400. The attacker first presents a dummy token, which Plex accepts because it only checks that the field exists.

Attack sequence and severity

It then forces the server to send a request to itself, which opens an internal interface reserved for the local machine. From there, it diverts the module that retrieves TV show listings to steal the administrator token. With this token, it pushes the video transcoder to write a malicious file in the codecs folder, which Plex then loads automatically.

High severity rating

Zach Main notes the entire set as 10 out of 10 on the CVSS severity scale, the maximum. He explains that he conducted this investigation largely based on AI models, while making the decisions himself. A hacker scanning the Internet randomly can therefore compromise a server without knowing anything about its owner.

Consequences of the attack

For now, the reward remains modest: the hacked servers become cryptocurrency miners (Monero, via the XMRig software), which run the fan and increase the bill. The honeypot is not the only cause: on the Plex forum, a user reports that his container started mining overnight.

Hidden risks and misuse

The most embarrassing aspect is elsewhere. Many Plex servers run on residential connections, and a private IP address allows an attacker to mask their traffic. On the honeypot, a proxy software called myawesomeproxy was installed in addition to the miner, warning in passing that the Internet traffic of the machine could be reused.

Mitigation and updates

Your box then serves as a cover for activities of which you are completely unaware. If automatic updates are enabled and the server displays version 1.43.3.10861 or newer, the vulnerability is fixed. NAS devices such as Synology, QNAP, Ugreen, TerraMaster, or equivalents require more attention, as the update goes through the manufacturer's package manager and may arrive late.

Persistent threat even after patching

Plex then advises downloading the package from its site and installing it manually. Updating is not sufficient if the server has already been visited. The malicious file remains in the Plex Codecs folder and restarts with each transcoding, even after turning off the miner.

Recommendations for users

If your server was exposed and was behind on the update, you should look for .so files (or .dll under Windows) that you did not place there. The best defense is not to expose Plex directly to the Internet: a server accessible only locally or behind a VPN avoids these automated scans.

Past incidents and risks

In 2022, the massive hacking of LastPass went through the personal computer of an engineer who had not updated his Plex, via a vulnerability fixed since May 2020, which required access to the victim's account. A forgotten multimedia server can become the entry point to something much more sensitive than a movie collection.

Urgent call to action

Good news, the patch has existed since September 1st. This means that a server still vulnerable today is most often vulnerable due to oversight, and hackers are counting on this. If your Plex is looking towards the Internet, go check its version now, before ending up in the Shadowserver statistics.