Where are the other zero’s \ud83d\ude02\ud83d\ude02\ud83e\udd37<\/p>\n
\u2014 nich0laus \ud83c\udfad (@nicl4ssic) October 18, 2026<\/a><\/p>\n ZM reported the issue to Plex on July 27th. Plex acknowledged it and paid a $500 bug bounty on August 4th, the same day the fixed build became publicly available to download. On September 1st, Plex posted a public advisory<\/a> and, according to BleepingComputer<\/a>, emailed users still on older versions. \u201cWe recommend all server owners and Desktop users update to the latest version as soon as possible,\u201d Plex wrote. The company also said it had requested CVEs, which were assigned on September 23.<\/p>\n \u201cUnauthenticated RCE chain in Plex,\u201d ZM posted<\/a> alongside the writeup and proof-of-concept code. \u201cPatch your servers!\u201d The $500 payout for such a critical exploit was immediately criticized, with multiple X users asking whether ZM had forgotten some zeros on the payout amount.<\/p>\n At the same time, an anonymous blogger who runs boredhackerblog<\/a> had been waiting for those details to be revealed. \u201cAs an infosec person and a Plex user, I was really curious about what this vuln was and if I could see in-the-wild exploitation,\u201d he wrote. He spun up a honeypot on an old Plex build. \u201cAs of this morning (Oct 17th), I finally saw in the wild exploitation using exploit code from the authors github,\u201d they reported Saturday. The first payload was a crypto miner. Later the same day, they also saw a tool called myawesomeproxy, which prints a notice that running it means agreeing to \u201cthe potential external use of your internet traffic.\u201d In other words, the attackers were turning the box into a residential proxy, the kind that other hackers rent to look like ordinary traffic while also masking their own IP addresses.<\/p>\n Kraken Chief Security Officer Nick Percoco cited the honeypot attack in an X post<\/a> on Sunday. \u201cIf you run Plex at home, update it today,\u201d he wrote, adding, \u201cThe payload sits in Plex\u2019s Codecs folder and runs again every time something transcodes, so killing the miner doesn\u2019t fix it.\u201d<\/p>\n Plenty of people still have not patched their Plex servers. Shadowserver data<\/a> on hosts tagged vulnerable-plex shows nearly 49,000 still exposed as of Saturday, including about 25,100 in North America and about 17,600 in Europe.<\/p>\n Plex has had its fair share of security incidents over the years. In September 2025, Plex told users to reset their passwords<\/a> after an unauthorized party accessed emails, usernames, and hashed passwords. A month earlier, after a separate bug bounty report, Plex emailed users and told them to update to version 1.42.1. Weeks later, with many servers still vulnerable, it went further. \u201cAs a follow-up to the original report and in an abundance of caution due to a population of servers still on an affected Plex Media Server version (versions 1.41.7.x to 1.42.0.x), we have made adjustments for access to affected servers,\u201d Plex wrote<\/a>. \u201cSpecifically, other users to which the server owner has granted access to the server will not be able to connect to it while the server is running an affected version.\u201d That flaw is now tracked as CVE-2025-34158.<\/p>\n Plex did not apply a similar access restriction, or otherwise require the update, after Plex2Shell became public. Its September 1st notice recommended an update and pointed Windows and Mac users at an optional automatic-update setting. That setting defaults to \u201cAsk me,\u201d not to auto-install, and Plex\u2019s own support docs<\/a> say it only applies to Windows and macOS. Linux, Docker, and NAS installs depend on package managers, container restarts, or manual downloads. Plex\u2019s terms of service<\/a> say the company can require an update \u201cas a means to protect the Plex Solution from unauthorized use, content, or data,\u201d and that declining one may cut off access. As of Sunday afternoon Eastern time, Plex had also not issued any new public statement about the exploit or the attacks that followed it.<\/p>\n A previous LastPass hack also shows that the stakes involved with this kind of vulnerability in Plex server software can be quite high. In 2023, LastPass said attackers got into a senior DevOps engineer\u2019s home computer \u201cby targeting the DevOps engineer\u2019s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,\u201d according to Ars Technica<\/a>. Ars reported that a person briefed on a private LastPass report identified the package as Plex; however, LastPass and Plex have not publicly confirmed that link in matching detail. Either way, it is the nightmare version of what a vulnerable residential Plex server can become when a remote code execution exploit is discovered.<\/p>\n","protected":false},"excerpt":{"rendered":"Plex shipped a security update in August that closed a chain of bugs letting anyone who can reach…\n","protected":false},"author":2,"featured_media":933932,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,13996,500847,238242,10664,477760,500848,105],"class_list":["post-933931","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-crypto","tag-cves","tag-hacker","tag-hacks","tag-plex","tag-remote-code-execution","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/933931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=933931"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/933931\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/933932"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=933931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=933931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=933931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Shadowserver](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/10\/Shadowserver-Plex-Exploit-Dashboard.jpg\")
Shadowserver Not the First Plex Exploit <\/p>\n