# Critical Plex Media Server Vulnerability Enables Unauthorized Cryptocurrency Mining Unpatched Plex servers are being exploited to hijack hardware resources and route malicious traffic. - **Source:** [How-To Geek](https://www.howtogeek.com) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/bb0a9f91-a7e9-490c-a2ec-6b0d8e476508 ## Plex2Shell Vulnerability Overview A critical security flaw dubbed Plex2Shell allows attackers to gain unauthorized control over Plex Media Servers. The exploit specifically targets versions older than 1.43.3.10861. By bypassing password requirements, hackers can execute remote commands over the internet, turning personal media hardware into tools for illicit activities without the owner's knowledge or explicit consent. ## Technical Exploit Chain Mechanism Discovered by a security researcher on October 16, the exploit chain combines four distinct bugs. This sequence tricks the server into surrendering the administrator's token. Once access is granted, attackers plant a malicious file that executes automatically during the standard video transcoding process, effectively compromising the system's integrity from within the application's core. ## Unauthorized Cryptocurrency Mining Operations Attackers are actively deploying payloads identified as mylovelyminer or x12345. These scripts hijack the host computer's processing power to perform cryptocurrency mining calculations. Victims typically experience severe performance degradation, significantly higher electricity costs, and increased hardware heat output, as the server's CPU is pushed to its limits by these hidden background processes. ## Network Traffic Proxy Exploitation Beyond mining, the exploit installs a tool named myawesomeproxy. This utility allows external actors to route their internet traffic through the victim’s home network connection. Consequently, malicious online activities appear to originate from the user's personal IP address, potentially exposing the victim to legal or security repercussions linked to the attacker's illicit traffic. ## Immediate Patching Requirements Users must update their Plex Media Server to version 1.43.3.10861 or newer immediately. You can verify your current installation status by navigating to the Plex Web Settings under the General tab. Applying this update is the primary defense against the Plex2Shell exploit chain, as it patches the specific vulnerabilities used for unauthorized access. ## Detecting Potential Server Compromise Plex advises users to monitor for suspicious activity, such as unexpected files located within the Plex Codecs folder or unfamiliar running processes. Additionally, consistently high CPU usage while the server is idle serves as a strong indicator of compromise. If these signs appear, the server may already be under the control of an attacker. ## Remediation and Recovery Steps If a compromise is suspected, Plex recommends performing a clean installation rather than reusing the existing data directory. Users should sign out of their accounts across all connected devices and reset their passwords immediately. Furthermore, disabling remote access in the settings menu provides an additional layer of security for users who do not require it. ## Security Implications for Media Servers This incident underscores the inherent risks associated with maintaining internet-accessible media servers without rigorous patch management. As vulnerabilities are publicly disclosed, the window for exploitation narrows rapidly. Proactive maintenance and disabling unnecessary remote features remain the most effective strategies for protecting personal infrastructure from becoming a target for automated botnet and mining campaigns. ## Sources covering this story - https://www.howtogeek.com/your-outdated-plex-server-has-a-serious-vulnerability-that-could-mine-crypto-for-hackers/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._