3,111 South African Plex servers are exposed as Plex2Shell attacks spread

At least 3,111 Plex Media Server installations in South Africa were reachable from the internet on 25 October, according to a count by Willem Steynberg, head of cybersecurity training at Orange Cyberdefense. Any of them still running a version older than 1.43.3.10861 is open to a chain of four flaws that Plex says is being "actively and widely exploited".

Plex is the software many people use to stream their own films, series and music from a home PC, NAS box or old laptop to a TV or phone. That is why the number matters here. "Plex is a consumer media product, so most of that population will be home and small-office servers," Steynberg told MyBroadband.

The fix is a free update. The risk sits with owners who switched on remote access years ago and have not opened the server's settings since. A server that only plays media inside the house, with remote access off and port 32400 not forwarded, is not the machine this alert is about. The machines in Steynberg's count answered from the public internet.

What the flaws do

Plex published its first advisory on 1 September for Plex Media Server 1.43.2 and earlier, and added a longer update on 19 October once attacks began. It lists four CVEs. CVE-2026-96652 is a server-side request forgery in the player timeline endpoint that needs no login. CVE-2026-96654 exposes internal agent functions over the loopback interface. CVE-2026-96655 discloses the server owner's admin token. CVE-2026-96656 allows files to be written to the Codecs folder through transcoder preferences.

Read in order, they are a sequence. The timeline endpoint can be abused without an account. That reaches agent functions that were only meant to answer the server itself. Those functions can reveal the admin token. With the token, an attacker can change transcoder settings so the server writes files into the Codecs folder. Chained, they let a remote attacker with no account run code with the privileges of the Plex process.

Plex says a public proof of concept appeared on 16 October and was followed by widespread attacks on internet-facing servers that had not been updated. Hijacked machines have been used to mine cryptocurrency and to run proxy software that routes other people's traffic through the victim's connection. The 1 September note described the bugs. The 19 October note is the one that says they are being used.

The US Cybersecurity and Infrastructure Security Agency added all four CVEs to its Known Exploited Vulnerabilities catalogue on 20 October. Federal agencies were told to deal with two of them by 23 October and the other two by 3 November. Those deadlines bind US federal systems, not a household in South Africa. They are still the public marker that the flaws are known to be exploited, which is the reason the quieter September advisory was followed by the October update. The catalogue entry does not say how many of the exploited servers are South African.

Why a home server is a South African problem

Steynberg's concern is what a compromised box becomes. "A compromised Plex host on a home connection is a proxy node inside a South African address range," he said. Traffic from a local fibre or LTE connection looks like an ordinary South African customer to banks, retailers and streaming services. The attacker's traffic borrows the household's address. The household's own browsing is not what the proxy is for. The proxy is there so someone else's traffic can leave from a South African IP.

The same machine often sits on the network a person uses to work from home. MyBroadband reports that an attacker on a Plex host can reach other devices on that network, including laptops. Plex itself tells owners to treat anything the Plex service account could reach as exposed, including mounted shares and credentials stored on the same machine. A film library on an external drive, and a work login saved in a browser on that PC, are in the same blast radius if they are reachable by the account Plex runs as.

For a small business that runs Plex on a machine holding client records, that turns a hobby server into a POPIA question. Section 22 of the Act requires a responsible party to notify the Information Regulator and affected people when personal information has been accessed by an unauthorised person. The section applies when there has been an actual compromise of personal information, not merely because a server was reachable. Owners who find the signs Plex lists are the ones who have to ask that question. Owners who only learn they were counted do not yet have a notification duty from the count alone.

This is the second mass-exploitation alert in a fortnight. South African web hosts were patching PHP2Shell on shared servers last week. That one sat on hosting companies' machines. This one sits on boxes people bought for their lounges.

What owners should do now

Plex's instructions are specific. Open Plex Web, go to Settings, then General, and confirm the version is 1.43.3.10861 or newer. Windows and macOS users can turn on automatic updates. NAS, Docker and Linux users need the package from Plex's downloads page. Nvidia Shield owners update through the Play Store. The version number is the check. A server that still shows 1.43.2 or anything older is the build the advisory names.

Then check for signs of compromise: unfamiliar processes started by Plex, such as ones named myawesomeproxy, mylovelyminer or x12345; unknown .so or .dll files in the Codecs folder; outbound connections to proxystream.st; or high CPU use when nothing is playing. Those names come from Plex's own note. They are examples of what investigators have seen, not a complete list of every miner name.

If any of those appear, or cannot be ruled out, Plex says to rebuild from a clean installation rather than reuse the old data folder, sign out of all devices and change the Plex password. Keeping the old data folder is how a written-in file can survive the update. Owners who do not need to watch away from home should switch off remote access under Settings, then Remote Access, and stop forwarding port 32400 on their router. Remote access is the feature that made the server part of the 3,111. Turning it off does not delete a miner that is already running. It stops new connections of this kind.

What is still unknown

Steynberg's count shows exposure, not infection. Neither Plex nor Orange Cyberdefense has said how many of the 3,111 South African servers were already patched, or how many have been taken over. A server on 1.43.3.10861 can still be reachable from the internet and still be outside this chain. A server on an older build, with remote access left on, is the one the advisory tells owners to treat as exposed. The count does not separate those two groups.

Steynberg's scanning method has not been published, so the 3,111 figure cannot be rechecked from the advisory alone. No local ISP has said whether it will warn customers whose connections show the proxy traffic Plex describes. CISA's last deadline for the chain is 3 November. That date is for US federal agencies. For a South African owner, the date that matters is the day the server's own settings page shows 1.43.3.10861 or newer, and the Codecs folder does not contain files Plex did not put there.