New to Plex? Your TV app is just a player; the risk is the Plex Media Server on your PC, NAS or Docker box. Keep it updated (Plex2Shell hit servers older than 1.43.3.10861 in Oct 2026), leave Remote Access off unless you need it, use a strong password with two-step verification, and check now and then for high CPU or strange uploads.

1. Know which part is the server. The Plex app on a Roku, Fire TV, Apple TV, smart TV or phone only plays video. The Plex Media Server is the program on the computer, NAS or container that stores your files, and that's what gets attacked. If you never installed a server and only stream Plex's free movies and TV, there is no server to patch; just keep your apps updated.
2. Turn on automatic updates and check the version monthly. In Plex Web go to Settings → (your server) → General and turn on update notifications; on Windows and macOS updates can install automatically. NAS app stores and Docker images can be weeks behind, so compare your version with the Plex downloads page once a month. For Plex2Shell you need 1.43.3.10861 or newer.
3. Use Remote Access only if you stream away from home. Remote Access (and any router port forward for 32400) puts your server on the internet, where scanners find it within hours. If everyone watches at home, disable it in Settings → Remote Access and remove the port forward. If you need it, keep the server updated and consider a VPN such as Tailscale or WireGuard instead of an open port.
4. Lock down the Plex account. Use a unique password and turn on two-step verification at plex.tv (Account → Security). Every so often, review Authorized Devices and remove anything you don't recognise. Share libraries with friends through Plex's sharing, never by giving out your login.
5. Don't run the server as an administrator or on your main work PC. Plex installs its own low-privilege service account on Linux and NAS systems. On a home PC, avoid running it under an administrator account you also use for banking or work. A small NAS or spare mini-PC keeps a compromise contained.
6. Watch for the signs. The fans spin up and the CPU sits near 100% when nobody is watching, upload traffic rises, or you see Plex settings you didn't change. All of these are reasons to check. See the step-by-step checks in the Plex2Shell alert.
7. Ignore "Plex security" emails that ask you to log in through a link. Real Plex notices point you to Settings or plex.tv. Type plex.tv yourself rather than clicking a link that asks for your password.

Background: Plex2Shell exploited after public PoC (Oct 2026).