Security researchers have discovered that hackers are actively exploiting four vulnerabilities in Plex Media Server, the popular app that’s used to stream films, TV shows, music, and other digital content from your own PC, server, or NAS device. Roll your own Netflix, in a sense.
These security vulnerabilities have been collectively named Plex2Shell and can be combined to remotely execute malicious code on unpatched Plex servers, all without the attacker even needing to log in.
According to Ars Technica, attackers have used the exploit to install programs that mine cryptocurrency and proxy services that enable internet traffic to be routed through the victim’s connection. Infected servers may also suffer from high CPU load and reduced performance.
The good news is, Plex actually patched these vulnerabilities back in September. The bad news is, a lot of Plex users still haven’t updated, leaving their setups and machines open to attack. Indeed, Plex confirms that the attacks are widespread and targeting servers that are accessible from the internet and have not yet been updated.
If you have Plex installed, you should absolutely check its version and update ASAP. You’ll want to update to version 1.43.3 or later. If you suspect that your machine was attacked or infected, you should also run an antivirus scan and check for any unknown background processes.
Plex recommends a clean reinstallation if an intrusion is confirmed, as a standard update doesn’t necessarily remove malware.