Exploit chain for four Plex bugs is public: update now or containerize your media stack
banteg · x · 2026-10-19
Exploit code for a four-bug chain giving unauthenticated code execution on Plex Media Server went public; attackers dropped a Monero miner on honeypots within a day. Patched builds (1.43.3.10861+) have been out since September.
Persistence gotcha: the payload sits in Plex's Codecs folder and reruns on every transcode—killing the miner doesn't fix it. Check for unfamiliar .so/.dll files if your server was exposed.
banteg's advice: all media stack apps have RCE histories, so isolate them with least-privilege users or containers—downloads client writes only to downloads, arr reads downloads and writes media, Jellyfin only reads media.
Related event: Actively Exploited Plex Vulnerability Chain Drops Miners on Old Servers(2 posts)→
More from Safety
- Crime group used Claude, Grok and Kimi agents to attack 400+ banks in Latin America — anshulkundaje · 2026-10-23
- Greg Brockman: AI makes hacking 100x more profitable and easier, upending hacker economics — gabriel1 · 2026-10-23
- Account hacks surge: 6-step emergency checklist plus an AI audit prompt — petergyang · 2026-10-23
- For consumer AI founders, 'When are you launching in Europe?' is the new 'When Android?'—only 100x worse — omooretweets · 2026-10-23
- mmitchell_ai questions whether the AI safety vs security framing stems from EA — mmitchell_ai · 2026-10-23
- MPI-Sec PhD Thesis on Vulnerability Detection Benchmarks Includes Pre-LLM Classic "Top Score on the Wrong Exam" — mboehme_ · 2026-10-23