Plex servers hijacked for crypto mining and proxy traffic after exploit code goes public

Attackers are exploiting four Plex flaws to take over internet-exposed servers, install cryptocurrency miners and route traffic through victims’ home connections.

Plex Media Server owners are facing a fast-moving security problem after attackers began exploiting a chain of flaws that can let an outsider run code on exposed systems without logging in. According to reporting from specialist security outlets and Plex’s own advisories, the exploit set has been linked to cryptocurrency miners and residential proxy software installed on compromised servers, with activity first observed shortly after proof-of-concept code was published on 16 October 2026.

The issue centres on Plex servers that were left reachable from the public internet, particularly those listening on port 32400 for remote access. Researchers describe a four-stage chain that can expose an admin token, write a malicious file into Plex’s codec directory and then execute it with the server’s own privileges. The vulnerabilities have been tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and together they create a path to remote code execution on unpatched systems.

Plex said the affected build was fixed in version 1.43.3.10861, which it released on 3 August 2026 after receiving the report from a researcher known as ZM on 27 July. The company confirmed the bugs and paid a bug bounty the following day. However, it did not publicly spell out the technical details until later, leaving owners with only a brief forum notice on 1 September that referred vaguely to security issues and urged updates.

That delay mattered because public disclosure was quickly followed by real-world abuse. ZM’s write-up and working exploit code appeared on 16 October, and researchers then observed intrusions within a day. Honeypot operators reported attackers dropping XMRig, a well-known cryptocurrency miner that consumes local CPU resources to generate digital coins for the operator, and a small proxy tool called myawesomeproxy. The proxy component is especially concerning because it can route other people’s traffic through the victim’s internet connection, making malicious activity appear to originate from a home network.

On 19 October, Plex tightened its wording and said the vulnerabilities were being “actively and widely exploited”, adding that compromised systems were being used both for mining and for proxy traffic. The company warned that any server older than 1.43.3.10861 and reachable from the internet should be treated as potentially compromised. Around the same time, the Shadowserver Foundation said it had found more than 36,000 exposed Plex servers still running vulnerable versions, with the United States accounting for a large share. Other estimates put the total number of Plex servers reachable from the public internet at close to 300,000.

The episode also highlights a recurring problem in consumer and home-office infrastructure: software that is installed once, left running and rarely checked again. On Windows and macOS, Plex can update itself only if automatic updates have been enabled; on network-attached storage devices and in containers, updates typically have to be applied manually. That makes exposed systems easy targets when a proof-of-concept becomes public. In a separate warning, the US Cybersecurity and Infrastructure Security Agency urged urgent action on the Plex2Shell flaws and told federal agencies to apply emergency safeguards by 23 October 2026.

Security researchers say users who exposed Plex to the internet should update immediately, review their servers for unfamiliar files or unexplained processor load and, where possible, keep remote access closed. Anyone running a version earlier than 1.43.3.10861 is advised to assume the system is vulnerable. If a server was both out of date and publicly reachable, analysts say it should be considered at risk of compromise until proven otherwise.