Plex Servers Face Active Attacks Despite an Available Patch

The Short Version

Attackers are exploiting four Plex Media Server vulnerabilities grouped under the name Plex2Shell, PCWorld reports. The account says the flaws can be combined to run malicious code on an unpatched server without signing in. Plex reportedly patched them in September, but internet-accessible servers that remain unupdated are still being targeted.

Why It Matters

A home media server can do more than deliver films and music when someone else gains control of it. PCWorld, citing Ars Technica, says attackers have installed cryptocurrency-mining software and proxy services that route traffic through victims’ connections.

The report also describes high processor use and reduced performance as possible effects. Those symptoms alone do not establish that a particular server has been compromised.

The Bigger Picture

The important distinction is between closing the vulnerability and dealing with something an attacker has already installed. PCWorld advises updating Plex Media Server to version 1.43.3 or later. It also reports that Plex recommends a clean reinstallation when an intrusion is confirmed, because an ordinary update may leave malware behind.

An available patch therefore does not mean every installation is protected, and installing it does not by itself establish that a previously compromised machine is clean.

What to Watch

The supplied report gives no victim count or complete inventory of affected versions. It identifies exposed, unpatched servers as the target, rather than establishing that every Plex installation has been attacked.

For owners, update status and evidence of a past intrusion are separate questions. Keeping both in view makes the reported remediation advice more useful than treating a successful software update as the whole response.

When did you last check the update status of software running on your home server or NAS?