1-minute read
What a defender needs to know
Plex says attackers are widely exploiting a four-flaw chain against internet-facing Plex Media Servers older than 1.43.3.10861. Compromised machines have run miners and proxy software that carries other people’s traffic through the owner’s internet connection. CISA listed the file-write flaw, CVE-2026-96656, as exploited on October 20, with an October 23 federal action date and a forensic-triage flag.
The chain reaches internal functions, discloses an admin token and writes into the Codecs folder before code runs as the Plex process. In Plex’s notice, the named signs include Plex child processes such as myawesomeproxy, mylovelyminer and x12345; unfamiliar .so or .dll files in Codecs; connections to proxystream[.]st; and high CPU use with no playback. Inspect those records on exposed older servers and consider the service account’s mounted shares and local credentials.
Check the installed build in Plex Web under Settings → General. Update to 1.43.3.10861 or newer and confirm the displayed build; manually install the Plex package if a NAS repository lags. If remote access is unnecessary, turn it off and remove unneeded 32400 forwarding. If compromise appears possible, preserve investigative evidence and follow Plex’s clean-rebuild guidance, sign out of all devices, and change the Plex password. Review the rebuilt host’s processes and outbound connections.