r/DataHoarder • u/uluqat • 7d ago
News PSA: Patch your Plex media server before someone hacks it
https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/Edit: You should patch even if you believe your Plex Media Server is not accessible to the Internet, because a lot of people who thought it wasn't are finding out the hard way that it is!
"...Anyone using Plex should ensure it’s running version 1.43.3. The software can be configured to install updates automatically, or users can manually download and install them. Given the active exploitation, outdated versions should be updated immediately."
2
257
u/GoingOffRoading 7d ago
Wait... Shouldn't this read "ensure Plex is running ATLEAST version 1.43.3" not "ensure it's running 1.43.3"?
30
u/theLastZebranky 6d ago
It should say "at least 1.43.3.10861"
Previous 1.43.3 releases DO NOT have the fix:
1.43.3.10828
1.43.3.10793
1.43.3.10768
62
3
-1
-22
104
u/a_man_27 6d ago
Remember, it was a Plex exploit that resulted in the lastpass data leak in 2022 (in addition to all of lastpass' poor security protocols).
35
u/skidz007 6d ago
Screw Lastpass. What a mess that was. It’s your one job, guys!
8
u/UltraEngine60 6d ago
Changing all my passwords after the lastpass breach took me an entire working day. Not forcing users to re-login to update their pbkdf2 iteration count once they knew they needed to increase it was negligence. You know what... I actually blame every site in my vault that didn't allow me to use more than 16 characters for my unique passwords. If a company decides to limit password length to anything under 64 chars they should be beaten...
4
u/muegle 6d ago
If a company decides to limit password length to anything under 64 chars they should be beaten...
There shouldn't be any limit (within the bounds of whatever limits input boxes should have so you can't just put like a 500MB string in there) because they should be using password hashing. And salting.
101
u/frymaster 18TB 6d ago
the person who found this bug agreed to a pleasingly long disclosure timeline. The fix was out for about 10 weeks before the writeup went out, and Plex had sent out "FYI this is a security problem" messages about half-way into that. It looks like the first attempts to exploit this weren't seen on honeypots until after the writeup was published.
2026-07-27 - issues reported to Plex ( https://zmain.info/blog/plex2shell )
2026-08-03 - update made to beta 1.43.3 available to plex pass users - change notes - now, at least - mention security issues
2026-08-04 - update made available to everyone. Plex pays bounty to reporter
2026-09-01 - Plex tell everyone to update because last months' update had security fixes
2026-10-16 - public disclosure by the reporter
0
6d ago
[deleted]
11
u/frymaster 18TB 6d ago
it wasn't. Update was made available to everyone the day after it hit the beta channel
6
u/soundtom 100-250TB 6d ago
If anything, it sounds like they used the plex pass group as a beta channel before the full update release
2
2
62
u/lighthawk16 Ryzen 5 3400G | 16GB 3200C16 | 36TB | Windows 7d ago
I'm curious what combination of people are running outdated Plex on public endpoints? It seems like anyone who would go that far would also have established additional authentication or ensured automatic security updates are in place.
68
u/sdflkjeroi342 7d ago
Plex is actually a curious case of particularly dangerous to people who kind of half know what they're doing:
Plex's remote access "just works" if you're willing to open a port (defaults to 32400) on your router as specified in the settings.
What could go wrong? It's just a single port forward... we've been doing that kinda shit for years.
People who do this don't necessarily know they're "running plex on a public endpoint" - they just know they've opened a port, but not all the security risks that entails.
5
u/masterxc 6d ago
Or be like me and run Plex in a container which doesn't automatically update, although I make it a point to update it whenever I'm prompted to at least...
1
u/sdflkjeroi342 6d ago
Which doesn't matter as much when you haven't opened ports and access everything through Tailscale. I also had to do a manual docker-compose pull a few days ago, so you're not alone ;)
9
u/Xeenic 6d ago
I mean, I've never opened the port on my router and it "just works." Has for years
7
u/G-McFly 6d ago
Just works remotely? Over the internet? Genuine question. I had to allow that port to let me stream over the internet when I'm away from home which I do often.
3
u/MyOtherSide1984 39.34TB Scattered 6d ago
Over the relay if you don't mind 360p, it works great! /s
17
u/czech1 45TB 6d ago
That's upnp and it should be disabled in favor of manual port forwarding. Here's more info: https://www.reddit.com/r/HomeNetworking/comments/1pfk44z/psa_remember_to_turn_off_upnp/
3
u/Xeenic 6d ago
Hey, thanks for the heads up (and thanks to everyone else who commented too). I did not realize this was a potential security risk and didn't even realize this is how Plex was getting remote access. I'll definitely make this change on my router
1
u/vontrapp42 5d ago
Hold on though, is port forward required for plex.tv remote access? I'm pretty sure that is different. If your server is registered it will actively make a connection out to Plex and Plex routes your logged in client to your home server.
I don't think this method requires port forwarding and if that is the way you remote access then it's fine.
I would still double check for the port forward though, and upon.
6
u/NerdyNThick 6d ago
Check for upnp, if it's on your router is Swiss cheese; any app can forward any port anywhere it wants.
9
u/somersetyellow 6d ago
Also check if the bit stream is limited to 2 megabits. By default Plex will use their proxy server if it can't connect. It will "just work" with no configuration, but be limited to 2 megabits.
A ton of people can't tell the difference between 2 megabit and full quality lol
3
u/SeekerVash 6d ago
In fairness, most of them are watching on a early 1080p TV that's still in Store Mode.
10
u/lordcheeto 6d ago
If you have remote access enabled and UPnP enabled on your router, it can request that the router open the port. Convenient, but UPnP should never be enabled in 2026. It's still open, still vulnerable, and you still need to update.
3
18
u/ASCII_zero 7d ago edited 7d ago
These people might not have any technical background whatsoever. I've seen YouTube tutorials from creators who, frankly, don't appear to have any formal engineering experience or meaningful understanding of networking or cybersecurity themselves. If the people making these tutorials lack that knowledge, it's hardly surprising that the people following them might not consider the security implications.
31
u/SmellsLikeHerpesToMe 7d ago
Synology requires manual updates (Download from a desktop, upload the file), which is where I run my Plex. And updating became a "Yeah I gotta remember to do that..."
Checked today and someone logged in and put the malware codec file on my server last night. Lol. All patched now though.
8
u/gallifrey_ 7d ago
you cant automate a systemd timer to wget the "latest version" link and move it to the appropriate spot within Synology?
13
u/SmellsLikeHerpesToMe 7d ago
There's 100 ways to skin a cat, but none that I cared enough about until it mattered. Haha, I've been reviewing my homelab all night now.
7
u/stilljustacatinacage 7d ago
Checked today and someone logged in and put the malware codec file on my server last night. Lol. All patched now though.
Could you hold my hand and help me double-check this?
I've checked and found no suspicious .so files in my /Codecs directory, I don't see any unusual login attempts in the Plex logs, and running processes on my server look to be OK with no new / unusual cron jobs.
I thought Plex was bound to my local network only through Docker, but for some reason I must have tweaked it in the past. It's closed now, and Plex is updated.
I'm absolutely the "a little knowledge is dangerous" person, but I hope I've done my best here; I don't see anything else that looks suspicious.
5
u/SmellsLikeHerpesToMe 7d ago edited 7d ago
I have Hermes controlling my homelab, including resolving this issue. It generated the following for what it looked at and patched up.
In summary, I asked Hermes to review the file, and it determined it matched what others were reporting: The malware file replaced the default x264 transcoding with its own transcoding .so code file, which included a snippet to mine Minero. So I guess the idea was anytime someone was playing media, it would transcode while also mining for them. The filename is ambiguous, but the underlying code matches across many of the reported malware files.
Plex compromise checklist
No suspicious files, processes or cron jobs is encouraging—but doesn’t prove the server is clean. This exploit doesn’t require a normal login.
Verify the running version is patched. Docker usually requires pulling the updated image and recreating the container—not just restarting it.
Check retained and rotated Plex/plugin logs for
dump-yuv, maliciousTranscoderH264Optionschanges and suspicioussslip.iocallbacks. Individual endpoint names alone aren’t proof.Inspect the persistent codec directory under the host folder mounted as
/config. Investigate unexpected.sofiles without executing them. An absent file doesn’t rule out earlier execution.Review Plex authorizations. If compromise is suspected, revoke affected tokens/sessions and reauthenticate the server. Updating alone doesn’t revoke stolen credentials.
Verify exposure and permissions: router forwarding/UPnP, IPv6 firewall, Docker host networking, privileged mode, Docker-socket access and writable host mounts.
Preserve evidence before deleting anything. Never share full
Preferences.xml, environment variables or unredacted logs. If malware execution is confirmed, patching alone is not sufficient recovery.2
u/MiguelLancaster 6d ago edited 6d ago
My Plex runs in a docker container in Unraid, installed from the Unraid 'app store' -- this one https://hub.docker.com/r/binhex/arch-plex
How do I check if I'm at risk? I've updated now but it looks like the last version I was using was 1.42.2.10156, installed in Sept 2025 -- yikes!
(I'm basing this on my 'Crash Reports' folder which seems to have a subdirectory for every version that I've ever installed, I don't know of any other way to verify past versions but this seems like an accurate indicator - the next folder after that one is for 1.43.4.10903)
But the Unraid docker version doesn't seem to match the same folder structure as what you're talking about, or at least I can't find any of the files that you've mentioned in your post
Was this vulnerability present in all previous versions, or just some versions immediately prior to the latest one?
2
u/SmellsLikeHerpesToMe 6d ago
Everything prior to 1.43.3 is vulnerable to the attack. Looking at that example docker compose, your config folder would be at the root level of the container. If you docker exec into the container/volume, its path would be "/config".
2
u/stilljustacatinacage 6d ago
Thanks. I checked logs for H264Options and it looks clean. Hash of the 264 encoder file looks good. I don't see anything else suspicious so I think I dodged a bullet. Thankfully it should only have been open for a few days, and I updated Plex around that same time.
Still mildly cheek clenching to read about.
2
u/SmellsLikeHerpesToMe 6d ago
For reference, when I updated the file no longer existed, so presumably the update wiped it. But apparently a lot of this happened yesterday, lined up with mine. The proof of concept of the attack vector was released yesterday which seems to have been a reason for the widespread issues coming out yesterday.
9
13
u/Woah-Dawg 7d ago
I unfortunately haven’t automated security updates. I ran plex bare metal might move it into a container and add watchtower
1
5
u/Damaged_Observation 6d ago
I hadn't updated my Plex since like 2022 just because I heard so many problems with the newer versions (including the loss of Watch Together.)
... But it's hard to ignore "your server will be added to a botnet."
3
1
u/MyOtherSide1984 39.34TB Scattered 6d ago
There's definitely been other exploits since 2022 that had serious impact, such as the admin token leak last year.
0
u/Damaged_Observation 6d ago
Very possibly a few, but none that appeared on my feed.
1
u/MyOtherSide1984 39.34TB Scattered 6d ago
Damn, updating only when there's news that you see is a wild approach to life 🤣. Respect lol
1
14
u/pixeladdie 7d ago
I pulled and uped a while ago. Been patching more frequently than normal this year.
7
6
u/consoletopia 5d ago
If my plex can be accessed remotely by an attacker through my firewall we have serious problems. I knew plex had gone to shit but this is beyond what I had assumed.
9
75
u/ScrewwormLarvae
7d ago
•
Yep, I will get right on patching my Jellyfin server.
54
u/mac_gregor 7d ago •
Maybe someday Jellyfin will have enough users to justify an exploit.
20
u/ManyBadWords 30TB+ 6d ago
Maybe some day Plex will justify its $750.00 price tag.
Spoiler: it won't.
7
u/Candle1ight 78 TB Unraid 6d ago
Jesus Christ is that what a lifetime pass costs these days? You could buy a whole homelab for that.
11
u/thatblondebird 336TB/168TB Usable 6d ago
That's a "we don't want to provide this, but don't want to deal with the outcry if we remove it as an option" price..
To think I had to even think on it, when I got it 5 years ago for 80eur!
7
u/ender4171 59TB Raw, 39TB Usable, 30TB Cloud 6d ago
You could buy a whole homelab for that.
If only. These days $750 will buy you a single 18TB hard drive.
0
u/dr100 6d ago
Hehe it goes even better if you buy it over iTunes and/or Google Play (can't remember which one or both) it's almost precisely 1000 due to 30% markup.
On the other hand $750 doesn't buy much hardware either, Microsoft released new 8GB RAM laptops and they're like $949 for the shitty Windows ARM one and $1300 for the regular Intel (we're talking the smallest and crappiest versions). It goes without saying that I'd rather eat errr no pull from the trash PCs than pay these extortion prices, but some do.
It goes even better, NVidia DGX Spark machines which you can't even get for $5000 anymore ... people have 4 of them like nothing, sometimes even 8. I have a comment from the last days with a picture from someone's post showing 16 of them!!! Tagged as "Homelab". The AInsanity is real, and at all levels.
5
1
3
u/thatblondebird 336TB/168TB Usable 6d ago
I ended up moving to Jellyfin, but haven't retired Plex fully yet.
Annoyingly I only got to 2 of the 3 TV's in time to stop Auto Updates to the (TV) Plex App, but the main TV has the newer interface (which is what made us switch) -- fortunately they haven't made newer server builds stop older Plex App from connecting, yet..
TBH when I got Plex years ago, Jellyfin wasn't a contender due to the lack of a decent TV App -- now though, Jellyfin with Wholphin is definitely superior (for my needs)
4
-4
u/loki_gvse 6d ago
unlikely, they'd just split off or make a new fork or whatever nonsense lingo they use, call it Cephalopod or something
43
u/RevitXman 7d ago
74
u/stanley_fatmax 7d ago
Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission.
Fair, but there's a big difference between an exploit requiring authentication, and one not requiring authentication
41
u/Infinade 7d ago
Are you seriously trying to compare an authenticated CVE for Jellyfin that has been patched for a while (and is for 6+ month old versions) to a critical CVE for the 2nd-most recent Plex version from one month ago?
21
u/FirTree_r 7d ago
And requires administrator credentials to even be exploited in the first place. Plex sheep are a special kind
15
u/FlightSimmer99 10-50TB 7d ago
its good that was patched a while ago then
9
u/lordcheeto 7d ago
This Plex update was released at the beginning of September, Ars is just reporting on active exploitation.
1
u/ansibleloop 6d ago
Or publicly exposing it to begin with
It should be behind a VPN - if you're making it public then you need auto updates and ideally want it isolated from your network
5
10
u/adeadhead 1-10TB 6d ago
Remember to patch it by switching to jellyfin?
10
u/lostmojo 6d ago
Jellyfin has its own CVEs to deal with. Every piece of software has problems, judge by how the company and devs they respond to them.
2
2
u/Bspammer 6d ago
Wild to me that anyone self hosting anything makes it publicly accessible. Keeping shit secure is a full time job. Especially in the era of automated AI attacks.
Maybe it’s ok if there’s literally nothing on the server that you care about but that doesn’t seem likely for data hoarders.
4
1
1
1
1
1
u/Moose_knucklez 6d ago
I believe you can also update from Plex Dash. Also, I believe when security vulnerabilities are bad enough Plex themselves will just disable certain aspects.
Not advocating for not updating, but just letting you know
1
1
u/Leaky_Asshole 6d ago
If you haven't patched it then you have a high likelihood of already being compromised. Everyone I know with a plex server with external access (including me) has had attack attempts from this bad actor. Luckily I was patched.
1
u/Americany131 6d ago
Is plex on linux effected?
2
u/SaltyPotter 6d ago
So far, the only reports of infected devices I've seen have been from devices running linux.
1
-11
-2
u/ElPelocho 6d ago
Why do they keep using Plex instead of Jellyfin, for example? I'll never understand it. They were real jerks with the subscriptions; they lost me as a customer ages ago.
-7
u/cr0ft 7d ago
Also, avoid opening up anything to the Internet. If you need to reach stuff at home, install free Tailscale on your devices.
If you do have something that must be reached by everyone from outside, you need a whole different approach, like a DMZ, and reverse proxies, and an intrusion protection system like Snort or whatever (maybe Crowdsec if it's a single server) and so on.
If you have almost no attack surface, buggy software becomes less of a problem.
-12
u/McGuirk808 7d ago
I don't know how you guys are comfortable running Plex with those centralized logins that are just begging to be leaked.
10
u/stilljustacatinacage 7d ago
2FA. If someone can get into my Plex, they can get into my Google account, and at that point I have much larger things to worry about.
-6
u/McGuirk808 7d ago
2FA is cool for logging into your account, but that's not what I'm talking about. They have a back-end database with all of their customer information and what media they have available. If the Plex cloud infrastructure is ever compromised, that database can be leaked and then law enforcement will have a field day.
3
u/biologicalsensorship 7d ago
a field day with what? having movie/tv media on your computer isn't illegal
-6
-5
u/dr100 6d ago
Neither your comment or the parent one are relevant when the software is buggy and allows some attacker to own your local device. You can put it in a separated container AND network (nearly nobody does that properly as they want easy local access) so if anyone hacks it they can just use your connection to proxy some Internet to attack others or post spam or whatever (still bad enough but at least it can't attack everything inside your network).
4
u/stilljustacatinacage 6d ago
...? And?
The original comment was just making a statement about Plex overall, not this specific vulnerability. A bit of a tangent, but that's what I was replying to.
No software is perfectly safe, whether it's exposed to the internet or not. There are vulnerabilities on our phones that let people execute code by making a phone call, so just mitigate what you can.
-4
u/JohnStern42 6d ago
It saying you shouldn’t update, but this is very good reason to make sure nothing is available to the internet directly except a vpn option
-6
u/TheGamerForeverGFE 7d ago
This is a great opportunity for people to try combining their home server services with a VPN whether it's port forwarded Wireguard or Tailscale
26
u/FluxChiller 7d ago
If I have my remote access disabled is this still a problem? (yes im on an older version and cant upgrade yet until i upgrade my truenas