Threat Pulse 62High
Plex2Shell: four Plex Media Server bugs chained into RCE, miners deployed
Severity 6PatchedconfirmedConsumer devices

Four vulnerabilities chained into unauthenticated remote code execution on exposed Plex Media Servers were used to drop XMRig miners and proxyware within hours of the proof of concept. Update to build 1.43.3.10861 or later.

What to do: Update to Plex Media Server 1.43.3.10861 or later

· 16 days ago · internet-exposed Plex Media Servers · Peak Cyber on Plex2Shell exploitation
SourcesPeak Cyber on Plex2Shell exploitationforums.plex.tvzmain.info
On X
@me_sagar_utekarunverified
Open on X
@zm_0xverifiedOct 16, 16:51 UTC

Unauthenticated RCE chain in Plex: $500 bounty Writeup: https://t.co/mpFPDLCPde PoC: https://t.co/cOli9jBryw Patch your servers! https://t.co/GUufC4wnuf

Open on X
Why this score

Home servers, exploitation seen, patch available

Back to the board

Updated Nov 5, 01:42 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.