highEndpointactiveCVSS 8.118 Oct 2026
Plex Media Server
Attackers are breaking into home media servers
What happened
Internet-exposed Plex servers are being compromised through a combination of stale versions and weak remote-access configuration. The result is a residential foothold that survives reboots.
Timeline
18 Oct 2026 · 17:20 UTC
Telemetry
A cluster of residential intrusions shares Plex as the entry point.19 Oct 2026 · 10:00 UTC
Patch
A server release closes the remote-access path.21 Oct 2026 · 20:00 UTC
Persistence
Responders find scheduled tasks surviving reboots.
Sources