Your Plex Server Is Now Someone's Cryptominer

Plex bugs are being exploited in the wild to drop cryptominers. Here's how to audit your server and lock down remote access today.

Dafallah Ibrahim

— 2 min read
Share

Today's ugly headline: Plex vulnerabilities are being exploited in the wild, and the payload is a cryptominer. Somewhere, a NAS in a developer's closet is quietly earning cryptocurrency for a stranger.

A miner is the loud payload. Its whole business model is burning your CPU. The quiet follow-ups — stolen tokens, pivoting into your LAN — don't peg any graphs. Treat this as a nudge to audit every self-hosted service you run.

Why this matters

Media servers are special. Most services you self-host are meant to stay private; Plex is one people deliberately expose, punching port-forward holes so they can stream from anywhere. That makes it one of the most common internet-facing services on home networks — exactly what opportunistic attackers scan for.

And nobody hardens the homelab. That "toy" box frequently holds your SSH keys, a Docker socket, a CI runner, or DNS for the whole house. An RCE in Plex is an RCE in all of it.

How it works

The chain is boring and reliable: find an internet-reachable Plex instance on an unpatched build, exploit the bug, land code execution, download the miner, then add persistence so a reboot doesn't help. Cron jobs, systemd timers, and tampered container entrypoints are the usual hiding spots.

Detection is easier than most intrusions. Miners must consume compute and phone home to a pool. Idle CPU pinned near 100%, unfamiliar process names, and outbound traffic to a stratum endpoint (often port 3333) are dead giveaways.

Where this helps

  • GPU transcode boxes: a miner competing with hardware transcoding shows up as streams stuttering that used to be smooth.
  • Plex-in-Docker hosts: containers don't save you. The miner only needs the container's CPU, and a modified entrypoint survives docker restart.
  • Shared VPS: when Plex runs next to Gitea, MinIO, or bots, one foothold reaches every token in the same network namespace.
  • Anything else you port-forward: Home Assistant, Gitea, the arr-stack — the pattern generalizes. Audit them with the same block below.

Watch out

  • Plex staggers server releases, so clicking "update" can still leave you behind the patched build. Verify the actual version number, not the green checkmark.
  • Killing the miner process doesn't remove persistence — it comes back on a timer.
  • Moving remote access behind Tailscale or WireGuard is the right call, but breaks streaming for non-technical family. Plex's relay mode keeps remote playback working without a port forward, just bandwidth-limited.
  • Snapshot before you nuke. If you want to know what else was touched, you need the evidence intact.

Try it yourself

Run this on any Linux box that hosts something internet-facing:

# What's eating CPU? A miner floats to the top
ps aux --sort=-%cpu | head -n 8

# Classic persistence spots
grep -rE "(curl|wget|base64)" /etc/cron* /var/spool/cron 2>/dev/null
systemctl list-timers --all | grep -viE "apt|logrotate|man-db|fstrim"

# Where does that suspicious binary actually live?
readlink -f /proc/<PID>/exe

# Docker hosts: containers you didn't start
docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Command}}'

TL;DR

  • Plex vulnerabilities are being actively exploited in the wild to install cryptominers on exposed servers.
  • Exposed media servers are RCE footholds into machines holding your keys, tokens, and containers — the miner is just the visible part.
  • Run the audit block today, verify your actual Plex version, and move remote access behind a VPN.

Read more