Hackers are breaking into Plex media servers with a new attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively breaking into Plex Media Server using a method called Plex2Shell. If your version is out of date, a stranger could steal your owner key and run their own code on the computer where Plex lives.

What happened

Plex2Shell is a chain of four separate flaws. On their own, they are rated medium to high in severity. Linked together, they let an attacker obtain the owner's admin token, which is a digital key that proves you are in charge, and then run code with elevated privileges. The researcher who found them, Zach Main, scores the full chain 9.8, a critical rating.

Main reported the problems to Plex on July 27. Plex released a fix on August 4. Main published full technical details on October 16 and a working proof-of-concept attack three days later. Reports of real attacks began on October 17.

Who it affects

Any Plex Media Server running a version before 1.43.3.10861 is exposed. Plex is software that organizes your movies, TV shows, music and photos and streams them to other devices at home or over the internet. That remote streaming feature is what makes a home server reachable by outsiders.

If you already run version 1.43.3.10861 or newer, you have the fix for these flaws.

What the attackers are doing

The first reported attacks went after honeypots, which are decoy servers set up to attract and study attackers. Their goal was to install a cryptominer. That is hidden software that uses your computer's power to earn cryptocurrency for someone else. It can slow your machine and run up your power bill. The material does not say how many real servers have been compromised.

What to do

The alert box above lists the steps. The short version: check your version, update right away, and consider turning off remote access until you have. Unexplained slowdowns or constant high processor use are worth a closer look.

What happens next

CISA has told federal agencies to patch or apply protections by October 23. Private users and businesses are not bound by that date, but it shows how urgent the warning is. With full details and a proof-of-concept now public, anyone can copy the attack against servers that stay unpatched.

CISA also added two other flaws to its list of actively exploited problems this week. One affects Siemens Software Center and the other affects the SiteGuard Server Edition web application firewall. Businesses that use either product should check their vendors' advisories.