Explore the latest developments concerning PSA: Patch your.
Hackers are using unpatched Plex servers as crypto miners, and yours may be at risk
The problem with set-and-forget devices is that you can, well, set them and then forget about them. It's good in terms of keeping it out of mind, but people can sometimes forget that their device still needs regular updates to stay secure. That's what's happening with Plex, as hackers are distributing Plex2Shell to devices that haven't been updated since August.
The new wave of hacks was spotted by BoredHackerBlog after they set up a Plex honeypot to goad hackers into installing malware on it. Once they noticed a trend, they took to Reddit to ask if people noticed anything with their unpatched servers:
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public.
The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. The code runs with the same privileges as the Plex service.
The issues were reported to Plex on July 27, and the company confirmed them and awarded a bug bounty on August 4. On September 1, Plex announced it had already shipped fixes and asked server owners to upgrade.
2025 Powerful 3000W Alexandrite Ice Platinum Laser Epilator Professional Diode Laser Machine Permanent Hair Remover for Woman
The dynamic landscape of current events often brings forth significant discussions. Monitoring these developments provides crucial insights.
For more detailed information, explore updates concerning PSA: Patch your.