Security researchers are urging Plex users to patch urgently after identifying thousands of internet-facing servers that could be hijacked to install malware or infiltrate home and small-office networks.
South African households running Plex media servers are being urged to patch urgently after security researchers identified thousands of exposed systems that could be hijacked through a newly described attack chain known as Plex2Shell. Willem Steynberg, head of cybersecurity training at Orange Cyberdefense, said he found 3,111 South African Plex Media Server instances exposed to the internet on 25 October 2026, leaving them open to compromise if they were running vulnerable versions.
Plex is widely used as a personal streaming platform, allowing users to store films, series and other media on one device and play them on phones, laptops and other screens. That convenience can create risk when remote-access features are left exposed. According to Steynberg, Plex2Shell combines four weaknesses, tracked as CVE-2026-96652, CVE-2026-96655, CVE-2026-96654 and CVE-2026-96656, to move from request forgery to unauthorised code execution. He said Plex has warned that the flaws are being actively and broadly exploited against internet-facing servers older than version 1.43.3.10861.
The concern is not limited to the media server itself. Steynberg said attackers could use access to install cryptocurrency miners and other malware, while a compromised home server could also become a foothold inside a wider home or small-office network. He noted that many affected systems are likely to belong to home users and small businesses, which means the danger is especially relevant for people who work from home on the same network as their Plex device.
The warning comes amid broader signs that personal streaming and browsing accounts remain attractive targets in South Africa. In August, NordVPN said cybercriminals had been harvesting browser cookies from South Africans and using them to bypass logins for services including Netflix, YouTube and Reddit. NordVPN said it had identified more than 263 million South African browser cookies in infostealer databases, illustrating how stolen session data can be used to gain access without a password. While that campaign did not carry the same network-level risk as Plex2Shell, it showed that consumer accounts and home devices are both part of a widening attack surface.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
