Plex confirmed on 19 October that four flaws in Plex Media Server, when combined, let an attacker with no account run code on the server over the internet. After proof-of-concept code was published on 16 October, attacks became widespread, installing cryptocurrency miners and proxy software. CISA added CVE-2026-96652, -96654, -96655 and -96656 to its Known Exploited Vulnerabilities catalogue on 20 October. The fix is available from version 1.43.3.10861.
What it means: Plex is one of the most popular programs for personal film and music libraries, and it often runs on a NAS, an old computer or a small office server. Many people have opened it to the internet to watch content away from home without thinking of it as a service that needs maintenance. That makes it an ideal target: a machine that stays on around the clock, with a good connection and often with access to shared folders on the network. The fix came out in early September, yet mass attacks began only once demonstration code was published, which shows that the critical window is the days after a flaw is analysed in public. NAS devices lag behind in particular, because vendor app stores do not always ship the new version straight away and a manual install is needed. For anyone running Plex the steps are simple: check the version in the settings, update, and turn off remote access if you do not use it. If the server was old and exposed, the safest option is a clean install, a new account password and a check of every folder and password that was reachable from the same machine. For small businesses, the case is a reminder to keep a list of which devices on their network are open to the outside, because a forgotten media server can become the door to the whole network.
Related service: Custom software