Hackers are using unpatched Plex servers as crypto miners, and yours may be at risk

Hackers are exploiting unpatched Plex servers to install crypto miners, posing a risk to users who may have forgotten to update their devices. The issue stems from the convenience of set-and-forget technology, which can lead to neglecting regular updates. This is precisely what has occurred with Plex, as hackers are targeting devices that have not been updated since August.

The malware, called Plex2Shell, was first reported to Plex in late July 2026 and fixed on August 4th. However, due to a lack of diligence in updating servers, the hackers are still able to infiltrate systems and install cryptominers. Plex2Shell installs itself using various processes and command lines, which users can check for to detect the malware.

As a precaution, anyone with an unpatched Plex server facing the internet should consider updating their device to prevent potential breaches.