Recently fixed Plex Media Server vulnerabilities are being actively exploited in the wild, with a published proof-of-concept exploit chain that its researcher developed using AI tools. Users are urged to update to version 1.43.3 immediately and harden their server configurations.
<p>Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.</p>
<p>Plex <a href="https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319">fixed</a> four vulnerabilities at the start of last month. Three weeks later, <a href="https://www.cvedetails.com/vulnerability-list/vendor_id-14994/year-2026/Plex.html">published CVE</a> designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week <a href="https://zmain.info/blog/plex2shell">revealed an exploit</a> that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell."</p>
<h2>Complex exploit chain</h2>
<p>The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination.</p><p><a href="https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/">Read full article</a></p>
<p><a href="https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/#comments">Comments</a></p>
# PSA: Patch your Plex media server before someone hacks it
Source: [https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/](https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/)
The published exploit chain was part of a proof\-of\-concept attack that the first researcher included when submitting a bug report to Plex\. The[complex code](https://github.com/code-zm/plex2shell)completes a series of steps, including performing an unauthenticated SSRF, a loopback pivot, a security token theft, a payload delivery, and finally the execution of the payload\. The bug finder said he used AI “heavily” to develop the exploit chain\. Steps included:
1. Recon: Break the system into logical components\. Map every path from user input to a dangerous sink\.
2. Hunt: Focused vulnerability hunt per component\.
3. Verify: Spawn a separate agent to try to disprove each finding\. If it can’t refute the bug, it’s likely real\.
4. Chain: Find
“This was not a matter of telling the LLM ‘go hack Plex,’” the researcher wrote\. “It was hours of iterative work, dead ends, and reprioritization\. All of the judgment calls on what to look for and what to prioritize were mine\. The LLM speeds this process up significantly, allowing me to stay at a higher level and simply guide the process\.”
Plex representatives didn’t immediately respond to questions\.
Anyone using Plex should ensure it’s running version 1\.43\.3\. The software can be configured to install updates automatically, or users can manually download and install them\. Given the active exploitation, outdated versions should be updated immediately\. Beyond that, users should devote care to properly securing the media servers\. The safest option is to restrict its access to local networks with no exposure to the Internet\. This option prevents being able to use many useful features, though\. One option when connecting a device to the open Internet is to[route traffic through a reverse proxy](https://www.xda-developers.com/ways-i-secured-my-plex-server-before-exposing-it-to-the-internet/), instead of using the default port 32400\. Users should also use only[secure Plex apps](https://support.plex.tv/articles/206225077-how-to-use-secure-server-connections/)\. And of course, strong passwords are a must\.
AWS threat intelligence reveals attackers began exploiting the critical PHP2Shell vulnerabilities four days before their public disclosure and patch release, highlighting how AI-accelerated exploit development is shrinking the window between patch and working exploit.
This Wired article examines why Plex users are frustrated with recent feature bloat and a price hike, and evaluates Jellyfin as a free, open-source alternative—finding it excellent for local streaming but more technically demanding for remote access.
OpenAI's Patch the Planet initiative and Google's Wiz used AI models like GPT-5.6 Sol and Gemini 4 Argon to uncover two critical, decades-old PHP vulnerabilities present since 2004, prompting an NSA warning and urgent patches from the PHP Foundation for the ~70% of websites running PHP.
PHP maintainers warn of two critical vulnerabilities rated 9.2/10 and plan to release emergency security patches within 12 hours, urging all PHP users to prepare to upgrade immediately.