Exploit code for Plex went public on Friday. By Saturday, servers were mining Monero

A researcher left a deliberately old Plex Media Server facing the internet to see what would happen. On 17 October, something did. Three machines, at 45.194.92.222, 91.92.40.202 and 176.65.139.228, ran the same attack in sequence and dropped two things on the box: XMRig, a Monero miner, and a proxy tool called myawesomeproxy that quietly rents out the victim's home internet connection to strangers.

The attack is called Plex2Shell, and it works by stacking four separate flaws. CVE-2026-96652 and CVE-2026-96655 let an attacker make the server fetch a URL of their choosing without a real login. CVE-2026-96654 points that request at an internal plugin interface. CVE-2026-96656, the serious one at CVSS 8.6, writes a file to disk as the administrator. The file lands in the Codecs folder and runs the next time Plex transcodes a video, which is why killing the miner does not get rid of it.

None of this is a surprise to Plex. The company shipped the fix in Media Server 1.43.3.10861 and posted a security announcement on 1 September. What changed last week is that a researcher published full technical details and working code on 16 October, and the first attacks followed within a day. Gizmodo reported roughly 49,000 servers still exposed on Saturday. If you run Plex at home, open it, check Settings and update. And ask yourself whether port 32400 really needs to face the open internet at all.

Keeping ordinary apps current is the dull half of staying safe, which is why Tendvane's app updater uses winget to show you what is out of date and update it in one go.