Run a Plex Server at Home? Hackers Are Breaking In. Update It Today

Who this affects

Anyone who runs Plex Media Server (the program that stores your movies, shows, music or photos on a PC, Mac, NAS box or other device and streams them to your TVs and phones): act today, especially if you can watch your Plex library from outside your home.
People who only use the Plex app on a TV, phone or browser to watch someone else's server or Plex's free movies and TV: these attacks target the server, not the apps. Keep your apps updated as usual.
Don't use Plex? Nothing to do.

Attackers are actively breaking into Plex Media Servers that haven't been updated, using a chain of four security flaws nicknamed “Plex2Shell.” No Plex password is needed. Plex says break-ins are “actively and widely” happening, and on October 20, 2026, the U.S. government's cybersecurity agency, CISA, added all four flaws to its list of flaws known to be used in real attacks.

⚡ The short version

Update Plex Media Server to version 1.43.3.10861 or newer today.
If you don't watch Plex away from home, turn off Remote Access in Plex's settings.
If your server was out of date and reachable from the internet, check it for signs of a break-in (below).

Why this one matters

Chained together, the flaws let an attacker on the internet run their own programs on your Plex server without logging in, according to Plex.
Instructions and working attack code were posted publicly on October 16, and break-in attempts were seen the very next day.
Plex says hacked servers have been used to run cryptocurrency miners (which slow the computer and run up power use) and “proxy” software that sends strangers' internet traffic through your home connection.
Plex's own advice: if your server is older than 1.43.3.10861 and was reachable from the internet, assume it may have been compromised.
The fix has been available since August; Plex asked owners to update on September 1.

Step 1: Check your Plex version

Open Plex in a web browser on the server (or go to app.plex.tv and sign in).
Open Settings (the wrench icon), then choose General under your server's name. The version number is shown there.
You want 1.43.3.10861 or higher. Check the whole number, not just “1.43.3”: Plex says only 1.43.3.10861 and later are protected.

Step 2: Update it

Windows or Mac: download the latest Plex Media Server from the Plex downloads page and install it over the old one. Your library and settings stay. Don't assume automatic updates already did it; check the version afterward.
NAS box (Synology, QNAP, WD, Netgear and others): the NAS app store may not have the new version yet. Download your device's package from the Plex downloads page and use the NAS's manual install option.
NVIDIA Shield: install any pending updates from the Google Play Store.
Linux: update the Plex package, then confirm the version in Settings › General.
Docker: pull the latest image and recreate the container (see Plex's Docker instructions), then confirm the version in Settings › General.

Step 3: Turn off Remote Access if you don't need it

If you only watch Plex on devices at home, go to Settings › Remote Access (listed under your server's name; Plex's help page calls it Settings > Server > Remote Access) and turn it off. If you set up port forwarding on your router for Plex (port 32400), remove that rule too. Plex recommends not forwarding that port unless you really need it. This shrinks the risk, but you still need to update.

Signs your server may have been hacked

The computer's fan runs loud or the processor stays busy even when nobody is watching anything.
Programs you don't recognize running alongside Plex. Plex named myawesomeproxy, mylovelyminer and x12345 as examples seen in attacks.
Unfamiliar .so or .dll files in Plex's Codecs folder.
Your server connecting to proxystream.st (check with your router or a tech person).

See any of these, or can't rule it out? Plex recommends reinstalling Plex Media Server fresh instead of reusing the old Plex data folder (at minimum, delete everything in the Codecs folder, and check Preferences.xml for transcoder settings you didn't set; that part is a job for a tech person). Then go to your Plex account settings, sign out of all devices, and change your Plex password. Anything else on that same computer, like shared folders or saved passwords, should be treated as possibly exposed too. If that sounds like a lot, ask a trusted tech person for help.

Watch out for scams about this

Big security news brings scammers. You may get emails, texts or calls saying “your Plex account was hacked” with a link to click or a number to call.

Don't click links in those messages. Go to plex.tv yourself by typing it in.
Never give passwords or remote access to someone who contacted you out of the blue. It's the same trick as the fake virus pop-up scam.

Run a Plex server at home? Hackers are breaking in. Update it today