Hackers are taking over old Plex servers. Check your version now

If you run Plex at home, an old copy of the server software could be quietly working for someone else. Plex says attackers are breaking into out-of-date Plex Media Servers and using them to mine cryptocurrency and pass strangers’ internet traffic through the owner’s connection.

Plex posted the warning on its security forum thread on 19 October (US time). It says the flaws are “being actively and widely exploited”.

Four small holes, one big one

The problems were fixed in Plex Media Server 1.43.3.10861, which Plex released to everyone on 4 August 2026. Plex first urged everyone to update on 1 September. It has now published the details: four separate flaws, catalogued as CVE-2026-96652, -96654, -96655 and -96656.

Most need a password or admin access on their own. One tricks the server into sending web requests for the attacker. Another lets an attacker write files into the folder where Plex keeps its video codecs. Chained together, Plex says, they let an attacker with no password run their own code on your server.

A security researcher, Zach Main, reported the flaws to Plex in July and published his full write-up, with proof-of-concept attack code, on 16 October. Widespread attacks followed.

What the attackers do with your server

Plex says hacked servers have been used for two things:

• Cryptocurrency miners. These burn your computer’s processor to earn money for the attacker. The usual sign is a busy, hot machine while nothing is playing.
• Proxy software. This routes other people’s internet traffic through your connection, so it looks as if it came from your home or office.

The attacker’s code runs with the same access as Plex itself. If you can’t rule out a break-in, Plex says to treat anything that account could reach as potentially exposed, including shared drives and passwords stored on the same machine.

Which servers are at risk

Every Plex Media Server older than 1.43.3.10861 is affected. Plex’s advice is blunt: if your server is older than that and reachable from the internet, “assume it may be compromised”.

Watch the full number. Earlier releases also start with 1.43.3, including 1.43.3.10828, which went to everyone in July, and they aren’t fixed. The newest public version is 1.43.4.10903.

Updating depends on where Plex runs. Plex’s server settings page says automatic updates during scheduled maintenance only work on Windows and macOS. Linux servers and NAS boxes need updating by hand or through their own app store, and NAS stores can lag behind. Docker users should follow Plex’s Docker instructions. Plex’s original post has the steps for each.

Signs your server was hit

Plex lists these warning signs:

• programs started by Plex that you don’t recognise, especially ones named myawesomeproxy, mylovelyminer or x12345
• unfamiliar .so or .dll files in the Plex Codecs folder
• connections to proxystream.st, or high processor use while nothing is playing.

If you find any of them, or can’t rule them out, Plex says to rebuild the server from a clean installation rather than reusing the old Plex data folder. At minimum, empty the Codecs folder and check Preferences.xml for transcoder settings you didn’t make.

If your Plex server is on a work machine or the office network, tell whoever looks after your IT. The same goes for any computer that shares drives with it. If a work account could be involved, our first-hour guide to a business email hack covers the password and sign-out steps.

Checklist

• Check your Plex version. In Plex Web, go to Settings, then General. You need 1.43.3.10861 or later.
• Update a NAS or Linux server by hand. Download the current package from the Plex downloads page if your NAS app store hasn’t offered it yet. Docker users should follow Plex’s Docker guide.
• Look for the warning signs. Check for processes named myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in the Codecs folder, and high processor use while nothing is playing.
• Rebuild if in doubt. If an old, internet-reachable server may have been hit, reinstall Plex cleanly instead of reusing the old data folder.
• If in doubt, sign out everywhere. If you can’t rule out a break-in, use Plex’s account settings to sign out of all devices, then set a new Plex password.
• Turn off remote access if you don’t use it. It’s under Settings, then Remote Access. Plex advises against forwarding port 32400 unless you need to.
• If in doubt, check what else it could reach. If you can’t rule out a break-in, change passwords stored on the same machine and review shared drives Plex could access.