Hackers Are Hijacking Plex Servers So Their Traffic Looks Like Yours. Check Yours Now

If you stream movies from your own Plex server, hackers may be using it right now to mine cryptocurrency and quietly route their traffic through your home internet connection — and they never needed your password to get in.

QNAP, the Taiwanese company popular for its NAS (network-attached storage) devices, has notified its customers to update the Plex app on their devices after attackers began exploiting four security bugs in Plex Media Server, collectively nicknamed Plex2Shell.^[1]

Plex Media Server is a popular app that lets people stream their own collection of movies, TV shows, and music to their TVs, phones, and laptops, at home or remotely over the internet. It’s often installed on NAS devices like QNAP’s.

Here’s everything you need to know about Plex2Shell and the steps you can take to protect against active exploitation.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How hackers can take over your Plex server

Plex2Shell allows an attacker on the internet to take over a server without logging in. The four bugs are tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Here’s how the attack works:

• First, the attacker gets past a check that only looks for the presence of a login token and doesn’t verify whether it’s real. The attacker uses this to trick Plex into sending requests to itself.
• Since Plex trusts its own internal requests, attackers can reach parts of the server that were initially meant to be off-limits.
• Once inside, the attacker exploits a sloppy address check that hands the owner’s admin token to any web address that merely starts like Plex’s own. The attacker then steals it using a lookalike address.
• The attacker can now act as the owner and abuse Plex’s video conversion feature to save a malicious program disguised as video frames into the folder where Plex keeps its codecs.
• The next time Plex starts converting a video, it automatically loads every file in that folder, allowing the attacker’s code to run with Plex Media Server's privileges.

By the end of the chain, a stranger on the internet can run their own code and software on your server without ever needing a password. This could allow attackers to gain control over the Plex server and access information available to the Plex process.

Depending on the server's permissions, this could expose personal files and other sensitive information. Such information could potentially be used by malicious parties to orchestrate identity theft scams, targeted phishing attacks, and even financial fraud.

Hackers are already exploiting unpatched Plex servers

This threat is no longer theoretical. Plex was originally notified of the vulnerabilities on July 27 by researcher Zach Main and acknowledged the report on August 4. Plex had fixed the bugs back in August. But Zach published a full technical write-up, along with working exploit code, on October 16.

Within a day, attackers were using it against unpatched servers exposed to the internet. According to a BleepingComputer report, CISA confirmed active exploitation of all four Plex vulnerabilities and added them to its Known Exploited Vulnerabilities (KEV) catalog on October 20. CISA gave federal agencies three days to remediate two of the four vulnerabilities, with a longer deadline of November 3 for the remaining two, and urged all users to upgrade to Plex version 1.43.3.10861 or later.

Reports of attacks started appearing on October 17. At first, attackers targeted Plex honeypots, which are decoy servers set up by researchers, to install cryptocurrency miners. Attackers also deployed proxy software that turns hacked servers into relays that malicious actors can use to route their traffic, hiding their own identities.

How to protect your Plex server from Plex2Shell

Plex2Shell affects Plex Media Server versions 1.43.2 and earlier. You can check your version in Plex Web under Settings > General. If it shows 1.43.3.10861 or later, you’re already protected against these bugs. If not, update to the latest version immediately.

Updating to the latest version stops new attacks, but it won’t remove anything that has already been installed. To find out if your server was likely reachable from the internet, check whether any of these applied while you were using an old version:

• Plex Remote Access was turned on
• Port 32400 was forwarded on your router
• Your router opened the port automatically through UPnP or auto-configuration

If it was exposed, QNAP advises users to treat the NAS as potentially compromised and perform a clean reinstall following QNAP’s remediation guide. This is important because the malicious file sits inside the Plex Codecs folder and runs every time a video is converted. So, just stopping the suspicious program won’t fix it.

Also, change your Plex and NAS passwords after signing out all devices from your Plex account, since stolen admin tokens could still work for attackers. QNAP also recommends changing your NAS admin and user passwords, turning on two-factor authentication, and changing passwords or keys saved on the NAS for other services, such as backup jobs and cloud connections.

Several signs of possible compromise include:

• The server runs unusually hot, slow, or busy when nothing is playing
• Unfamiliar files appear in the Plex Codecs folder
• Unexpected programs are started by Plex
• Connections are made to unknown IP addresses

If you don’t need to watch media away from home, turn off Plex Remote Access and stop forwarding port 32400. If you do need remote access, we recommend using a VPN (virtual private network) instead of exposing Plex directly to the internet. Also, keep your NAS operating system, QTS or QuTS hero, and all installed apps up to date.

The bottom line

The Plex Media Server vulnerability highlights the importance of regularly updating the software you use. Although the fix was made available in early August, exploitation only started in mid-October, giving users time to update the platform. Failure to do so left internet-facing Plex Media Server users exposed to Plex2Shell.

To stay safe, ensure that you upgrade to Plex Media Server version 1.43.3.10861 or later, even if you have already updated. QNAP recommends a full clean reinstall of the application in case you were already infected. Change your passwords, log out of all active sessions, and enable 2FA wherever available.

All-in-One Digital Security App with Servers in All 50 U.S. States

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On NordVPN's website

2026 Editors’ Choice

Best Features

VPN

NordVPN

PROMOTION: Get 78% Off + Get 3 Extra Months

• VPN that earned the only Platinum rating in a five-way independent speed and security test by Artifact Security
• Historically unlocks Netflix libraries in the US, Canada, UK, and Australia with no errors
• Bundles with an ad blocker, dark web monitoring, and encrypted cloud storage for a more complete privacy setup

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news