Plex emailed its users this week. If you run a media server, do what it asks.

Plex does not normally write to you about patches. On 1 September it posted on its own forum and emailed people running affected versions, asking them to update Plex Media Server to 1.43.3 and Plex Desktop to 1.115.0 "as soon as possible". Anything on Media Server 1.43.2 or earlier is in scope.

What the flaws actually are, Plex is not saying. The forum post reads: "CVEs have been requested and we'll reply to this thread with more details once they're published." That reticence cuts both ways. It buys a little time before somebody compares the old and new code and works out what was fixed, but it also leaves you unable to judge the risk for yourself. The email is the tell. Nobody writes to their entire user base about a minor bug.

A media server is an awkward thing to leave unpatched, because it is the machine in the house that never gets turned off, and plenty of people have opened theirs to the internet so they can watch their own films from a hotel. Updating from the server's own settings page takes a minute. If yours lives on a Synology, QNAP or Unraid box, install the package by hand rather than waiting for the store version to catch up, because those repositories run days behind. And while you are in there, it is worth asking whether remote access needs to be switched on at all.

The hard part is usually remembering the box exists. Tendvane's Network scan lists everything currently sitting on your home network, which is a decent way to rediscover the NAS in the cupboard that has been serving films since 2021.