Plex Media Server Is Being Hacked: Update Now and Lock Down Remote Access
Updated
If you run Plex Media Server at home, update it today. If you use Plex port forwarding or UPnP for remote access, review those settings and secure your home Wi-Fi. On October 18, 2026, Cord Cutters News reported that attackers are already using a chain of flaws in older versions of Plex Media Server to take over the computers it runs on. Here's what's happening, how to check your version and how to lock down your home network.
What's happening
The problem is a set of four related vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 and nicknamed Plex2Shell. They affect Plex Media Server versions before 1.43.3.10861. Chained together, they let an attacker who can reach your server over the internet run their own code on it without a password.
Plex sent notices and emails to affected users around September 1, 2026, recommending that anyone on version 1.43.2 or earlier upgrade. Many didn't. Scans in September found more than 36,000 internet-facing Plex servers still unpatched. Working exploit code went public on October 16, and by October 17 a security researcher saw it used against an older Plex server deliberately left exposed as a trap. So far that's the only confirmed attack, but public exploit code usually leads to wider attacks quickly.
What the attack does
In the observed attack, the hackers installed an XMRig-based cryptocurrency miner and a proxy program called myawesomeproxy. The miner burns your computer's processor and power. The proxy is worse for your home network, since it routes outside traffic through your internet connection, so strangers' activity can look like it's coming from your address.
Cord Cutters News lists the warning signs: unexpected programs launched by the Plex Media Server process, processes named myawesomeproxy, mylovelyminer or x12345, references to the domain proxystream.st, and unfamiliar library files in Plex's Codecs folder. Servers on Linux or in Docker containers that are reachable from the internet are the most exposed.
How to protect your Plex server
- Update Plex Media Server to version 1.43.3.10861 or newer. You can check your version in Plex's server settings under General.
- Turn off Remote Access in Plex if you only stream at home.
- Remove any port forwarding rule for port 32400 on your router if you don't need outside access. Our port forwarding guide shows where those rules live.
- If you do need remote streaming, expose only port 32400, keep Plex on automatic updates and keep the server on its own network segment, such as a separate VLAN or guest network, away from your work laptop and cameras.
- Check your router's connected-device list and traffic for anything unusual. Our guide to checking router history walks through it.
- If you see signs of compromise, the safest fix is to back up your media, wipe the machine and reinstall from scratch, then change your Plex and router passwords.
The same habits protect everything else on your network. Our guide on securing your home Wi-Fi network covers router passwords, firmware updates and guest networks. For other Plex news, see our story on Plex's Roku app fixes.
Why upload speed matters for Plex
Streaming your Plex library away from home depends on your upload speed, not your download speed. Cable plans often upload at 10 to 35 Mbps, while fiber plans usually upload as fast as they download. If remote Plex buffers even on a clean, updated server, a plan with faster uploads may be the fix.
Need faster upload speeds for Plex?
We'll compare fiber and cable plans at your address and show you the real upload speeds.
Frequently asked questions
What is the Plex2Shell vulnerability?
Plex2Shell is the name for a chain of four flaws in Plex Media Server versions before 1.43.3.10861. Together they can let an attacker run code on the server without logging in, according to Cord Cutters News on October 18, 2026.
Which Plex version fixes it?
Plex Media Server 1.43.3.10861 or newer. Plex emailed affected users around September 1, 2026, recommending upgrades for anyone on 1.43.2 or earlier.
Is anyone actually being attacked?
Public exploit code appeared on October 16, 2026, and a researcher saw it used against an older Plex server set up as a honeypot on October 17. The attack installed a cryptocurrency miner and a proxy that routes outside traffic through the victim's home internet.
Should I turn off Plex Remote Access?
If you only watch Plex at home, yes. Turning off Remote Access and not forwarding port 32400 on your router keeps the server off the open internet. If you need it away from home, keep Plex updated and expose only that one port.
Can a hacked Plex server slow my internet?
Yes. A miner uses your computer's processor, and a proxy sends strangers' traffic over your connection, which can eat bandwidth and upload capacity. Call 1-877-697-2926 if you're also shopping for a faster plan.
Want to compare internet at your address?
Call us and we'll check every fiber, cable, 5G and satellite plan available where you live.