Your outdated Plex server has a serious vulnerability that could mine crypto for hackers

Credit: Corbin Davenport / Plex Published Oct 20, 2026, 12:07 PM EDT Viraj Gawde is a Tech Journalist with bylines at Travel+Leisure India & South Asia, Android Headlines, 91Mobiles, Croma Unboxed, etc. He has written thousands of news pieces, how-to guides, product comparisons, listicles, and op-eds on consumer tech. Currently, Viraj is obsessed with the fast-evolving world of artificial intelligence and how it is reshaping the way we work, create, and use tech. As a curious generalist, Viraj's work extends into a wide range of subjects, formats, and storytelling styles. When away from desk, he is a finance, sports, and travel geek with a constant curiosity for new experiences. Sign in to your How-To Geek account Hackers are exploiting security flaws in your Plex Media Server, turning it into a tool for mining cryptocurrency and routing other people’s internet traffic. Users who haven’t updated their Plex servers and are still running a version older than 1.43.3.10861 are affected. The flaw is nicknamed Plex2Shell, which allows hackers to take control of the server over the internet without a password. Plex2Shell exploit is hitting unpatched Plex servers What exactly happened A security researcher found the flaw and publicly released the technical details with proof-of-concept code on October 16. In simple terms, the exploit chain combines four bugs that work together, allowing the attacker to trick the Plex server into handing over the owner’s admin token. A harmful file is then planted that runs the next time Plex converts a video to play on a device. The attackers moved fast. An anonymous blogger monitoring the vulnerabilities observed attackers successfully exploiting the Plex server. The first payload was a cryptocurrency miner called "mylovelyminer" or "x12345." It uses a computer’s processing power to perform calculations associated with cryptocurrency mining. Running one without the owner’s knowledge can mean high CPU usage, a bigger power bill, and heat output. The second tool named myawesomeproxy allows strangers to route their internet traffic through your home connection. This means that outsiders can make their online activity appear to originate from the victim’s IP address. If your server was exposed Users should update their Plex Media Server to version 1.43.3.10861 or later. You can check the installed version by opening Plex Web > Settings > General. The streaming service also recommends looking for unfamiliar processes, unexpected files in the Plex Codecs folder, or an unusually high CPU usage when nothing is playing. If you think your server is compromised or find any suspicious activity, Plex recommends rebuilding the server from a clean installation instead of reusing the old data directory. Lastly, users should sign out of their account on all devices and change the password. People are also advised to disable remote access if they don't need it under Settings. The incident highlights the risks of leaving an internet-accessible media server unpatched. It's always a sensible way to keeping internet-accessible servers updated to reduce the chances of becoming the next target. Source: Plex Community Forum