How to Update and Lock Down Plex Media Server After Plex2Shell

Plex Media Server is popular for streaming films, music and photos at home, in hotels, lounges and small offices, often running on a NAS box, an old PC or a mini server. This month it became a target. On 21 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added four Plex Media Server flaws, together nicknamed Plex2Shell, to its list of actively exploited vulnerabilities. This guide is for anyone who runs a Plex server and wants to make sure it is patched and not quietly working for someone else.

Key takeaways

• Plex Media Server versions before 1.43.3.10861 are vulnerable. Plex released the fix in early August 2026.
• Chained together, the four bugs let an attacker steal the owner’s admin token and run code on the server.
• Exploitation was seen from 17 October, a day after technical details were published, with attackers installing a cryptocurrency miner and a hidden proxy.
• Update first, then review Remote Access, Network settings and port forwarding.

Why this matters

The flaws are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Individually they range from medium to high severity, but the researcher who found them, Zach Main, scored the full chain as critical. According to reports from The Hacker News, compromised servers have been loaded with an XMRig cryptocurrency miner and a Linux backdoor that turns the machine into a proxy, which means strangers could route their internet traffic through your connection. For anyone paying for data or power, that is a direct cost, on top of the security risk.

Before you start

• Know where your server runs: Windows, macOS, Linux, Docker, a NAS (such as Synology or QNAP) or an NVIDIA Shield.
• Have the admin Plex account login ready, and enable two-step verification on it if you have not already.
• Back up your Plex application data folder or Docker volume, which holds your library database.
• Schedule a short maintenance window. Streams will stop while the server restarts.

Step-by-step: update Plex Media Server

Step 1: Check the version that is actually running

1. Open a browser on your network and go to http://SERVER-IP:32400/web, replacing SERVER-IP with your server’s local address.
2. Sign in, open Settings and look at the server version shown under your server’s settings.
3. If it is lower than 1.43.3.10861, you must update. Check any second or standby servers too.

Step 2: Install the update for your platform

• Windows and macOS: let the server update itself or download the current installer from Plex’s official downloads page. Restart the server if the installer does not, then recheck the version.
• Linux: download the .deb or .rpm package that matches your distribution and architecture, install it with your package manager and confirm the service has restarted.
• Docker: note your current container settings, back up the persistent volume, pull the current official image and recreate the container with the same volumes and network settings.
• NAS: if your NAS app store still offers an older version, download the package from Plex directly and use your NAS vendor’s manual install option. Do not trust an “up to date” label; compare the version number.
• NVIDIA Shield: install any pending updates through Google Play.

Step 3: Confirm the fix

Reload http://SERVER-IP:32400/web and confirm the running server now reports 1.43.3.10861 or newer. A downloaded installer that was never run does not count.

Step-by-step: harden your settings

Step 4: Review Remote Access

1. Go to Settings > Server > Remote Access.
2. Ask whether you really need to stream from outside your home or office. If not, disable Remote Access and remove the related port forward on your router.
3. If you use Manually specify public port, check that the router forward points only to internal port 32400 on the right machine. Remove any old or unknown forwards.
4. If you could not update immediately, disabling Remote Access is a sensible temporary measure until you can.

Step 5: Review Network settings

Go to Settings > Server > Network (click Show Advanced if needed) and check:

• Secure connections: set to Required if all your devices support it; otherwise keep Preferred.
• List of IP addresses and networks that are allowed without auth: Plex warns that devices listed here are treated as the owner. Keep it empty or limited to specific trusted devices, never a whole network range you do not control.
• Strict TLS configuration: turn on to block outdated TLS versions, after confirming older TVs or apps still connect.
• Custom server access URLs: remove anything you do not recognise.

Step 6: Check for signs of compromise

• Look for unusually high CPU use or fan noise when nobody is streaming, a classic sign of a crypto miner.
• Check running processes for names you do not recognise, such as the reported “mylovelyminer” and “myawesomeproxy”.
• Review your router’s data usage for unexplained uploads.
• If you find signs of compromise, disconnect the server, back up your media, reinstall the operating system or container cleanly, install the patched Plex version and change your Plex password.

Troubleshooting

• Clients cannot connect after setting Secure connections to Required: switch back to Preferred and update the client apps.
• Remote Access shows as not available after the update: confirm the port forward and the manual public port match, then click Retry.
• Docker server lost its library: the container was recreated without the original volume. Stop it and recreate it with the same volume mapping.

Quick checklist

• Server version is 1.43.3.10861 or newer, including standby servers.
• Remote Access is off unless you truly need it.
• No unknown router port forwards.
• The “allowed without auth” list is empty or tightly limited.
• Admin account has a strong password and two-step verification.
• No unexplained CPU load or upload traffic.

Sources

• BleepingComputer: CISA says hackers chain Plex flaws in Plex2Shell attacks
• The Hacker News: Hackers exploit Plex2Shell flaws
• Plex Support: Remote Access
• Plex Support: Network settings
• Plex Media Server 1.43.3 security update guide