A media server is the most forgivable thing to expose to the internet. It is also, this month, the most expensive.

On 20 October 2026 CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalogue at once. Chained, they let an attacker with no credentials obtain an admin token and execute code as the Plex process. The researcher who found them scores the chain 9.8.

The patched build, 1.43.3.10861, was released on 4 August . Everything that has happened since is about the gap between a fix existing and a fix being installed, and that gap is the only part of this story you control.

The timeline, because it is the argument

Date Event

27 July 2026 Researcher Zach Main reports the chain to Plex

3-4 August 2026 Plex Media Server 1.43.3.10861 ships with the fix

Early September 2026 Shadowserver counts over 36,000 internet-exposed servers still unpatched

16 October 2026 Full technical write-up published

17 October 2026 First in-the-wild exploitation observed, against…