Attackers target unpatched Plex servers to deploy cryptominers and proxy software

Cybercriminals are targeting internet-facing Plex Media Server installations to hijack systems for cryptocurrency mining and proxy routing. Plex has acknowledged that the attacks are widespread across unpatched servers accessible over the web, warning users to immediately apply updates. [2][3]

Security researchers identified a chain of four vulnerabilities, collectively dubbed Plex2Shell, which allow attackers to remotely execute code on vulnerable machines without needing to authenticate or log in. Once inside, intruders deploy malware that routes external internet traffic through the host's connection and consumes system resources, resulting in heavy CPU loads and degraded streaming performance. [2][3]

Although Plex originally issued fixes in September with version 1.43.3.10861, many server operators have yet to update. The company urges users running older software to upgrade immediately. For setups where an intrusion has already occurred, Plex advises performing a complete reinstallation, as simply applying the software patch will not clear out previously installed malware. [2][3]