Plex Emailed Every User About Undisclosed Security Flaws — Here's What Devs and Sysadmins Need to Know

#security #selfhosted #devops #linux

## Plex Emailed Every User About Undisclosed Security Flaws — Here's What Devs and Sysadmins Need to Know

Most vendors bury a security patch in a changelog nobody reads. Plex didn't. This week, it emailed its entire user base directly — a step it reportedly reserves for its more serious advisories.

What Happened

Plex shipped Media Server 1.43.3 and Desktop 1.115.0 to patch multiple undisclosed security vulnerabilities.

❌ No CVE published yet
❌ No CVSS score
❌ No technical details
✅ CVE identifiers have been requested

Plex says it will publish more details once the CVEs are assigned.

Why the Silence Is the Story

Releasing exploit-relevant details before users patch just hands attackers a roadmap. But once a patch is public, researchers (and attackers) can diff binaries between versions to reverse-engineer the fix — often faster than most self-hosters update.

Translation: treat this as a patch-now situation, not a wait-for-the-CVE situation.

Why This Matters Beyond Home Labs

Plex has real history here. A previous flaw, CVE-2020-5741, was the entry point attackers used in the 2022 LastPass breach — they compromised a DevOps engineer's home Plex server, planted a keylogger, and used the harvested credentials to access LastPass's corporate vault.

If your org has engineers running Plex, NAS boxes, or remote-access tools on home networks — that's still attack surface.

How to Update

Linux:

# Debian/Ubuntu
sudo dpkg -i plexmediaserver_*.deb

# Fedora/CentOS/RHEL
sudo rpm -Uvh plexmediaserver-*.rpm

Docker:

docker pull plexinc/pms-docker:latest
docker stop plex && docker rm plex
# redeploy with existing volumes/env vars

NAS devices: App-store packages often lag — grab the official installer directly from Plex if your package manager hasn't caught up.

Quick Checklist

[ ] Confirm full build number (not just "1.43.3") — some sub-builds predate the fix
[ ] Update Desktop to 1.115.0
[ ] Audit remote access — disable if unneeded
[ ] Check logs for unfamiliar sign-ins
[ ] Don't expose Plex directly to the internet without a reverse proxy/VPN

Full platform-by-platform breakdown here: https://www.xpert4cyber.com/2026/09/plex-security-update-hidden-flaws.html

What's your home-lab security setup look like? Curious how many of us are running Plex behind a reverse proxy vs. straight port-forwarded.

DEV Community