A Plex honeypot was hijacked after an unauthenticated exploit chain surfaced
The operator reported a cryptominer and proxy on one old server; Plex urged upgrades in September, and the public chain targets versions before 1.43.3.10861.
By Ryan Merket · Published
Primary source: X
Why it matters
A single honeypot report does not establish a broad campaign, but it shows the practical consequence of a remotely reachable, unpatched home server: attackers may use its compute and network access after chaining flaws into server-level code execution.
A researcher says attackers turned an outdated Plex Media Server honeypot into a cryptocurrency miner and proxy, days after a public write-up described an unauthenticated route to server takeover. The report, amplified in an October 18th post by International Cyber Digest (@IntCyberDigest), concerns one observed honeypot, not a confirmed wave of compromised Plex users.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.