Hackers are using unpatched Plex servers as crypto miners, and yours may be at risk

The problem with set-and-forget devices is that you can, well, set them and then forget about them. It's good in terms of keeping it out of mind, but people can sometimes forget that their device still needs regular updates to stay secure. That's what's happening with Plex, as hackers are distributing Plex2Shell to devices that haven't been updated since August.

Plex2Shell is turning unpatched Plex servers into cryptominers

Make sure your Plex server is up-to-date

The new wave of hacks was spotted by BoredHackerBlog after they set up a Plex honeypot to goad hackers into installing malware on it. Once they noticed a trend, they took to Reddit to ask if people noticed anything with their unpatched servers:

"If you are running an old version of plex that is internet facing, specifically linux or in docker, could you do process list (ps axjf should show a tree as well, you may see Plex Media Server process having a suspicious child process) and check for the following:

• processes: myawesomeproxy, mylovelyminer, x12345, wget/curl to an IP address downloading a weird script file

OR

• process command line containing: --rig-id, proxystream[.]st, --donate-level"

Sure enough, people flocked to the thread to report that either they spotted the process on their Plex servers, or they pointed to other threads on the Plex subreddit where people were reporting the malware.

This malware, known as "Plex2Shell," was reported to Plex back in late July 2026; the exploit was fixed on August 4th, and knowledge of the exploit was made public on October 16th. As per the report for one of the four exploits Plex2Shell used, all Plex servers running version 1.43.3.10861 or later should be protected.

However, because people tend to leave their servers running without updating, hackers are still using Plex2Shell to break into people's servers and install cryptominers on them. If you have a Plex server you haven't updated in a while, and it's facing the internet, now may be a good time to give it an update.