Actively Exploited Plex Vulnerability Chain Drops Miners on Old Servers

A four-vulnerability chain in Plex Media Server enabling unauthenticated RCE has been publicly disclosed and actively exploited, with a honeypot compromised within a day and used to drop a Monero miner. Patches have been available since September, and experts urge upgrading to 1.43.3.10 or isolating old servers.

2026-10-19 ~ 2026-10-19 · 2 related posts

• Exploit chain for four Plex bugs is public: update now or containerize your media stack — banteg · 2026-10-19
• Plex2Shell: unauthenticated RCE chain (CVSS 10.0) already exploited in the wild, patch Plex now — evilsocket · 2026-10-19