Attackers are combining four flaws in Plex Media Server, collectively called Plex2Shell, to take control of servers. CISA has added the issue to its list of actively exploited vulnerabilities, and attacks began appearing on 17 October.

• What it is: A chain of four vulnerabilities that together can let an attacker steal the owner's admin token and run their own code on the server. Individually the flaws are rated medium to high, but combined they score 9.8 out of 10.
• Who is affected: Anyone running Plex Media Server older than version 1.43.3.10861, including servers on office networks or staff-owned devices.
• The risk: A compromised server can be used to run malicious software, such as cryptocurrency miners, and as a foothold into the rest of your network. Technical details and a proof-of-concept are now public.
• What to do: Update Plex Media Server to version 1.43.3.10861 or later, which has been available since 4 August.

We recommend checking whether Plex is installed anywhere in your business, updating it immediately, and removing it from work systems if it is not needed. Contact us if you would like help checking.

Source: BleepingComputer