Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes—Plex says attackers are actively exploiting four vulnerabilities in Plex Media Server to install malware. If your server is running a build earlier than 1.43.3.10861, update it now and verify the complete version number. A patch closes the known vulnerabilities, but it does not prove an internet-reachable server was not compromised before it was updated. Plex advises checking for signs of malware and following its recovery guidance if compromise is suspected or cannot be ruled out.
What is affected—and what version is safe?
The issue affects Plex Media Server, the software that hosts and streams a Plex library. It is not simply a vulnerability in every Plex playback app or every device that plays Plex content. Plex identifies 1.43.3.10861 or later as the fixed version threshold. Verify the full build number: some earlier releases labeled 1.43.3, including 1.43.3.10828, remain vulnerable, according to CERT Vanuatu.
As an Amazon Associate I earn from qualifying purchases.
The affected software includes Windows, macOS, Linux, NAS packages, and container images. Update availability and steps can differ by platform and package channel, so do not assume that an automatic update—or a package labeled only “1.43.3”—installed a fixed build.
How can the vulnerabilities install malware?
Plex says four linked flaws can let an unauthenticated remote attacker execute code with the privileges of the Plex Media Server process. In practical terms, an attacker does not need to sign in to exploit the chain against a vulnerable server they can reach.
Popular on Amazon
- CVE-2026-96652: unauthenticated server-side request forgery in the player timeline endpoint.
- CVE-2026-96654: access to internal agent functions over the loopback interface.
- CVE-2026-96655: disclosure of the server owner’s admin token.
- CVE-2026-96656: arbitrary file write to the Codecs directory through transcoder preferences.
Plex’s security notice says the flaws are being actively and widely exploited. The company reports compromised servers running cryptocurrency miners and proxy software that can route other people’s traffic through the victim’s internet connection. CERT Vanuatu warns that attackers may also reach mounted shares and credentials available to the Plex service account. Ars Technica reported active scanning and successful infection attempts observed by a researcher’s honeypot after exploit details became public; that observation is evidence of attacks, not a count of total victims.
How do I check and update Plex Media Server?
First check the version Plex Web reports, then update through the channel appropriate to your host. After installation, check the version again and confirm it is 1.43.3.10861 or later.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
- Open Plex Web and go to Settings → General to check the server version, as Plex directs.
- Install the latest available Plex Media Server update for your operating system or package channel. Linux, NAS, and Docker users may need to update manually, depending on their distribution or provider.
- Return to Settings → General and verify the full installed build. If it is below 1.43.3.10861, the server has not reached the fixed threshold.
NAS packages can lag behind upstream releases. If the package channel has not yet supplied a fixed build, check the platform provider’s security notice and Plex’s update guidance; do not treat an unavailable package or an ambiguous version label as confirmation that the server is safe. QNAP has also published a security notice on the Plex Media Server vulnerabilities.
How can I tell if my Plex server has malware?
Plex names several warning signs to look for. Their absence does not conclusively prove a server was never compromised, especially if it ran an older build exposed to the internet.
Also popular on Amazon
- Unfamiliar processes started by Plex, including names such as
myawesomeproxy,mylovelyminer, orx12345. - Unfamiliar
.soor.dllfiles in the Plex Codecs folder. - Outbound connections to
proxystream.st. - Sustained high CPU use when nothing is playing.
These indicators come from Plex’s response guidance. High CPU use alone is not proof of infection, but paired with an old, internet-reachable server it warrants investigation.
What should I do if the server may be compromised?
Treat updating and incident response as separate tasks. If an old build was reachable from the internet, Plex advises assuming it may have been compromised; updating alone does not remove a possible implant or undo access to credentials.
Recommended Free Tools
Also popular on Amazon
- Rebuild from a clean installation if you find indicators or cannot rule out compromise. Plex advises not reusing the old Plex data directory.
- At minimum, clear the Codecs folder and inspect
Preferences.xmlfor transcoder options you did not set. Follow Plex’s current recovery guidance for the exact procedure appropriate to your installation. - Sign out devices and change your Plex password. Also consider any credentials available to the Plex service account exposed, and assess mounted shares that account could access.
- Patch and verify the full build before returning the server to service.
If you do not need remote streaming, Plex recommends turning off Remote Access. Avoid directly forwarding port 32400 unless you need it. Reducing exposure is useful, but it is not a substitute for installing the fixed build or investigating a potentially compromised server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is Plex being hacked, and how widespread is it?
Plex says vulnerable internet-facing servers are being attacked, but the cited advisories do not provide a reliable population-wide count of infected servers or affected users. A honeypot’s scan and infection observations show that exploitation is happening; they cannot establish how many real servers have been compromised. The useful decision for an owner is whether the server ran a vulnerable build and could be reached from the internet—not whether a precise global victim count is known.
Also popular on Amazon
Frequently Asked Questions
Does this vulnerability affect Plex apps on my TV or phone?
The reported flaw is in Plex Media Server, rather than simply in a client app used to watch content. Update the server host even if you stream through a separate TV, phone, or tablet app.
Can I just delete the Plex Codecs folder to remove an infection?
Plex lists clearing that folder as a minimum action, but its guidance recommends a clean rebuild when compromise is suspected or cannot be ruled out. A folder cleanup alone does not address potentially exposed credentials, mounted shares, or other changes an attacker may have made.
Should I change passwords for other accounts on the server?
Plex specifically warns that credentials available to the Plex service account may be exposed. Identify what that account could access, including mounted shares, and rotate affected credentials as part of your response.
How do I protect Plex if I still need remote streaming?
Keep Plex Media Server on the fixed build and limit unnecessary exposure. Plex advises avoiding a direct port 32400 forward unless needed; the cited guidance does not establish a specific alternative remote-access configuration as a complete fix.
