More than 36,000 internet-exposed Plex servers were reportedly unpatched as attackers began exploiting a four-bug chain that can deliver passwordless remote code execution.
Plex users who expose their media servers to the internet have been warned of a chain of vulnerabilities that can allow an attacker to take over an unpatched installation without needing a password. According to security write-ups and the original report by Frandroid, the flaws have already been packaged into public exploit code, and at least one researcher said a test server was targeted almost immediately after disclosure. Shadowserver, meanwhile, had already counted more than 36,000 exposed Plex servers that were still unpatched earlier this month.
The attack path hinges on four separate issues in Plex Media Server versions earlier than 1.43.3.10861. SentinelOne’s vulnerability notes say two of the bugs are server-side request forgery issues, allowing crafted requests to make the server contact arbitrary internal or external destinations. Another flaw permits remote code execution through malformed URL handling in a plugin-related function, while the last lets an attacker write files that Plex later loads and executes. In combination, they can be chained to move from a reachable server port to arbitrary code execution in the Plex process.
The French report says researcher Zach Main notified Plex of the weaknesses on 27 July and later published a full analysis and proof-of-concept code on 16 October. The company had already pushed users towards version 1.43.3 on 1 September, and the specific fixed build is 1.43.3.10861 or later. According to the report, one honeypot was attacked the day after the code became public, reinforcing the concern that opportunistic scanning has already begun.
The immediate payload appears to be cryptocurrency mining rather than more destructive malware. Frandroid reported that compromised servers were used to run XMRig, a Monero miner, which would raise CPU load, increase fan noise and add to electricity costs. On Plex’s own user forum, one customer said a container began mining without warning, suggesting the activity is not limited to isolated test systems.
Security researchers also caution that the real risk goes beyond the miner itself. Because many Plex servers sit on residential internet connections, an attacker can use a private household IP address to hide malicious traffic behind a legitimate-looking connection. In the honeypot case described by the report, a proxy tool named myawesomeproxy was also deployed, indicating that the compromised machine could be repurposed as a relay for other network activity.
For users, the first step is to confirm that Plex Media Server is updated to 1.43.3.10861 or newer. Frandroid noted that auto-update is not always reliable on NAS devices from vendors such as Synology, QNAP, Ugreen and TerraMaster, where package updates may arrive late through the manufacturer’s software. Plex recommends manual installation from its own package if necessary, and users should also check for suspicious files in the Codecs directory, since the malicious component can persist and reload whenever transcoding is triggered.
Experts say the safest option is not to expose Plex directly to the public internet at all. Keeping the service local-only, or placing it behind a VPN, removes it from the automated scans that routinely sweep for forgotten ports. The episode is a reminder that a home media server, once left reachable from outside, can become an entry point into a much wider part of a network.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
