Plex vulnerabilities being exploited in the wild to drop a cryptominer
A security researcher details the exploitation of vulnerabilities in Plex Media Server that allow for remote code execution and the deployment of cryptominers. The report confirms that threat actors are actively using these exploits in the wild.
Why it matters
It highlights the ongoing security risks associated with popular home media software and the rapid weaponization of disclosed vulnerabilities.
(No AI was involved in writing, research, etc...)
If you see weird fonts and spacing, blame Blogger.
Skip to "In the wild exploitation" if you just care about that part.
It's just a cryptominer. On one hand that's not a big deal for victims on the other hand, I don't get interesting c o n t e n t to write about.
I wouldn't be surprised if threat actors deploy more sophisticated things. Plex may be hosted on residential IP and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails. (edit: see update at the bottom. i do see proxy being deployed now)
Back on September 1st, 2026, Plex sent out emails and did a security announcement regarding important security updates. See the post here: https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in