If you run a Plex Media Server at home, now is the time to check for updates. Security researchers say a Plex Media Server vulnerability chain, nicknamed “Plex2Shell,” is being actively exploited in the wild to install cryptomining malware and residential proxy software on unpatched boxes. Plex fixed the underlying flaws last month, but plenty of servers haven’t been updated, and attackers are already scanning for them.
What’s actually being exploited
Plex patched four vulnerabilities at the start of last month. Roughly three weeks later, published CVE listings revealed five vulnerabilities in total, with one rated 8.6 out of 10 in severity. A researcher then published an exploit that strings four of these flaws together into a single attack chain capable of achieving remote code execution on a vulnerable server. That chain, dubbed Plex2Shell, walks through several steps: an unauthenticated server-side request forgery, a loopback pivot, theft of a security token, delivery of a malicious payload, and finally execution of that payload on the target machine.
Notably, the researcher who built the proof-of-concept said they used AI tools extensively to help find and verify the bugs, though they stressed the process still required hours of manual iteration, dead ends, and judgment calls about what to prioritize. The AI reportedly sped up the grunt work rather than doing the hacking outright.
What attackers are installing
Once the exploit chain went public, a separate researcher set up a honeypot, a fake Plex server designed to attract and log attacks. Within a day, it was being actively scanned, and soon after, successfully compromised. The attackers are deploying two types of payloads. The first is a cryptominer that uses the victim’s hardware and electricity to generate cryptocurrency for the attacker’s wallet. The second is residential proxy software, which lets other people route their internet traffic through the infected device to mask their real location and identity. Since many Plex servers run on home internet connections, they make especially attractive residential proxies, something attackers reportedly value for accessing corporate VPNs and email accounts under a cleaner-looking IP address.
How to protect your server
Plex has already shipped a fix: anyone running the software should confirm they’re on version 1.43.3 or later. Plex can be set to update automatically, but given that exploitation is already underway, it’s worth checking manually rather than waiting for an automatic update cycle to catch up.
Beyond patching, a few habits meaningfully reduce exposure. The safest setup keeps Plex limited to your local network with no direct exposure to the open internet, though that sacrifices remote streaming features many people rely on. If you do need external access, routing traffic through a reverse proxy instead of exposing the default port, 32400, is a stronger option. It’s also worth sticking to official, secure Plex apps and using strong, unique passwords on the account tied to your server.
Signs your server may already be compromised
One Ars Technica reader who found an old, unpatched Plex server already hacked reported unfamiliar files appearing in temporary directories, unexpected cron jobs tied to the Plex user account, and unusually high CPU load that makes the server sluggish even over a remote connection. Anyone who suspects their server was exploited before patching should look for leftover scripts and scheduled tasks left behind by the malware, not just install the update and assume the problem is resolved.
The bottom line
This is a straightforward case where patching promptly actually matters. Plex2Shell isn’t a theoretical risk, it’s being exploited right now to turn home servers into cryptominers and proxy relays. Updating to 1.43.3, tightening remote access, and keeping an eye out for signs of compromise are simple steps that close the door on an attack that’s already circulating.
Source: Ars Technica
Where to buy
As an Amazon Associate I earn from qualifying purchases.
