Simon is a Computer Science BSc graduate who has been writing about technology since 2014, and using Windows machines since 3.1. After working for an indie game studio and acting as the family's go-to technician for all computer issues, he found his passion for writing and decided to use his skill set to write about all things tech.
Since beginning his writing career, he has written for many different publications such as WorldStart, Listverse, and MakeTechEasier. However, after finding his home at MakeUseOf in February 2019, he would eventually move on to its sister site, XDA, to bring the latest and greatest in Windows, Linux, and DIY electronics.
Sign in to your XDA account
The problem with set-and-forget devices is that you can, well, set them and then forget about them. It's good in terms of keeping it out of mind, but people can sometimes forget that their device still needs regular updates to stay secure. That's what's happening with Plex, as hackers are distributing Plex2Shell to devices that haven't been updated since August.
Plex2Shell is turning unpatched Plex servers into cryptominers
Make sure your Plex server is up-to-date
The new wave of hacks was spotted by BoredHackerBlog after they set up a Plex honeypot to goad hackers into installing malware on it. Once they noticed a trend, they took to Reddit to ask if people noticed anything with their unpatched servers:
"If you are running an old version of plex that is internet facing, specifically linux or in docker, could you do process list (`ps axjf` should show a tree as well, you may see Plex Media Server process having a suspicious child process) and check for the following:
- processes: myawesomeproxy, mylovelyminer, x12345, wget/curl to an IP address downloading a weird script file
OR
- process command line containing: --rig-id, proxystream[.]st, --donate-level"
Sure enough, people flocked to the thread to report that either they spotted the process on their Plex servers, or they pointed to other threads on the Plex subreddit where people were reporting the malware.
This malware, known as "Plex2Shell," was reported to Plex back in late July 2026; the exploit was fixed on August 4th, and knowledge of the exploit was made public on October 16th. As per the report for one of the four exploits Plex2Shell used, all Plex servers running version 1.43.3.10861 or later should be protected.
However, because people tend to leave their servers running without updating, hackers are still using Plex2Shell to break into people's servers and install cryptominers on them. If you have a Plex server you haven't updated in a while, and it's facing the internet, now may be a good time to give it an update.