Plex servers are being exploited. Updating and recovering are different jobs

An old Plex server that still plays films normally may already be doing something else in the background. Plex says attackers are exploiting a chain of flaws in internet-facing installations, and CISA has added the four vulnerabilities to its exploited-vulnerability catalogue. The immediate job is to check the server, not merely update the app on the television.

Plex's October 19 security update identifies 1.43.3.10861 as the first unaffected server build. The patches arrived earlier; the current urgency comes from confirmed attacks. Owners of exposed, older installations should treat this as a possible incident as well as an overdue update.

Find the computer doing the serving

Plex divides the job between the software that stores and serves a library and the clients that play it. That distinction makes a deceptively simple difference: a current television app does not establish that the NAS or PC behind it is current. Open the server's own settings and check its version there. If another household member administers it, send them the advisory rather than assuming your app-store update covered the machine.

The CISA bulletin lists CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Their inclusion establishes observed exploitation, not that every Plex installation has been breached. Nor is a federal remediation deadline a grace period for a home server. The relevant questions are whether the vulnerable version was running and whether attackers could reach it.

A successful update is only part of recovery

Plex reports miners and proxy software on compromised machines. Its advisory recommends a clean rebuild when compromise is found or cannot be ruled out, together with account sign-out and password changes. Follow the incident-specific instructions linked above; a normal migration procedure has a different purpose.

That difference is visible in Plex's ordinary server-migration guide, which explains how to carry the old data directory and settings to another installation. That is useful when moving a healthy library. Applying it unquestioningly during recovery could also carry over the very state you are trying to stop trusting. Preserve what is needed for investigation and recovery, but do not confuse copying everything with establishing a clean starting point.

For a NAS, also distinguish the package offered by its app store from the package available for that exact device. A familiar update button can lag behind a vendor release. Conversely, downloading the wrong architecture or package is not a shortcut: use the device-specific route in Plex's notice and verify the result.

Playback is a poor security test

A media server's most visible task is serving media. An unwanted background process does not need to interrupt that task to be useful to an attacker. “The film played yesterday” consequently tells you little about the integrity of the system today.

This is the practical side of server security: restoring the service and restoring confidence in the machine are separate outcomes. The first may take a package update. The second starts with checking what was exposed, and ends only when the installation you keep is one you have a reason to trust.