October 20, 2026 — Plex server owners should verify their installed version now. Plex says four vulnerabilities in older Plex Media Server builds are being actively and widely exploited against internet-facing systems.
The safe threshold is specific: Plex Media Server 1.43.3.10861 or later. In Plex Web, open Settings → General and check the full version number rather than assuming an automatic update succeeded. NAS package repositories can lag, so appliance owners may need the official manual package.
What Plex confirmed
In an October 19 update to its September security advisory, Plex disclosed four flaws: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Plex says an unauthenticated remote attacker can chain them to run code with the privileges of the Plex Media Server process.
A public proof of concept appeared on October 16. Plex says it subsequently observed widespread attacks on internet-facing servers that had not been updated. Compromised machines have been used to run cryptocurrency miners and proxy software that routes other people’s traffic through the victim’s connection.
This does not mean every outdated installation has been infected. Plex’s warning is narrower: if a server is older than 1.43.3.10861 and reachable from the internet, its owner should assume compromise is possible and investigate.
What to check
- Unknown processes launched by Plex Media Server, especially
myawesomeproxy,mylovelyminerorx12345. - Unfamiliar
.soor.dllfiles in the Plex Codecs folder. - Outbound connections to
proxystream.st. - Sustained high CPU use when the server is idle.
Updating closes the known chain, but it does not remove an infection that is already present. If those indicators appear—or if compromise cannot be ruled out—Plex recommends rebuilding from a clean installation instead of reusing the old Plex data directory.
Plex also advises signing out every device, changing the Plex account password and treating anything the server process could reach as potentially exposed, including mounted shares or credentials stored on the same machine or virtual machine.
If remote streaming is not needed, turn off Settings → Remote Access. Plex also recommends avoiding a direct port-forward of 32400 unless remote access is required.
The defensive order is straightforward: verify the exact build, update immediately, inspect any previously exposed server, and rebuild from a clean base if its integrity is uncertain.
