Loading story…
Plex has urged users to immediately update Plex Media Server and Plex Desktop to address multiple undisclosed security vulnerabilities. The affected Media Server releases are version 1.43.2 and earlier; Plex issued Media Server 1.43.3 and Plex Desktop 1.115.0 as the remediated versions and has requested CVE assignments.
Plex has not disclosed technical details of the flaws, leaving defenders with limited information while increasing the risk that attackers could reverse-engineer the updates to identify vulnerable systems. Organizations running Plex on NAS devices should verify availability through their vendor package manager and manually install the updated server package where the vendor has not yet published it.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
A Metasploit auxiliary scanner module, auxiliary/scanner/http/plex_media_server_file_read, was proposed to retrieve arbitrary files readable by a Plex Media Server instance. Its example targets port 32402 and requests /etc/passwd from localhost.
Plex released Plex Desktop version 1.115.0 to address the newly disclosed security issues.
Plex released Plex Media Server version 1.43.3 to remediate multiple security vulnerabilities affecting version 1.43.2 and earlier.
Plex warned users about the high-severity credential-theft vulnerability CVE-2025-34158 affecting Plex Media Server.
CISA added the Plex Media Server remote-code-execution vulnerability CVE-2020-5741 to its Known Exploited Vulnerabilities catalog after evidence of active exploitation.
Attackers reportedly exploited Plex Media Server CVE-2020-5741 to compromise a LastPass employee's home computer during the LastPass breach and installed keylogger malware.
Shadowserver internet scans identified more than 36,000 publicly reachable Plex Media Server instances that remained vulnerable, including about 16,000 in the United States and nearly 1,550 in Germany. No active exploitation had been reported at the time of the report.
Plex disclosed multiple undisclosed vulnerabilities in Plex Media Server 1.43.2 and earlier and urged Media Server and Plex Desktop users to update immediately. Plex requested CVE assignments, withheld technical details pending publication, and emailed affected users; NAS users may need to manually install the patched server package.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcexakep.ru
Open sourcescworld.com
Open sourcecryptika.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourceforums.plex.tv
Open sourceplex.tv
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
QNAP has addressed several security vulnerabilities affecting its License Center application and other NAS tools, which could allow attackers to access sensitive information or disrupt services on affected devices. The vulnerabilities, identified as CVE-2025-52871 (out-of-bounds read) and CVE-2025-53597 (buffer overflow), require an attacker to have access to a valid or administrator account, making credential theft or weak passwords a significant risk factor. QNAP has released patches in License Center 2.0.36 and later, urging organizations and home users to update immediately, especially if their NAS devices are accessible from the internet or shared among multiple users. In addition to the License Center flaws, QNAP also patched high-severity SQL injection and path traversal vulnerabilities in its NAS products. These vulnerabilities could have allowed attackers to execute arbitrary code or access restricted files, further emphasizing the importance of timely updates. Users are advised to access the QTS or QuTS hero management interface and apply the latest security updates to mitigate these risks and protect sensitive data stored on QNAP devices.
Jun 29, 2026
German CERT published two advisories affecting **Proxmox Virtual Environment (PVE)**, including one issue that can lead to **information disclosure** and a later notice covering **multiple vulnerabilities** in the virtualization platform. The advisories, `2026-1012` and `2026-1243`, indicate that organizations running Proxmox should review exposed management infrastructure and assess whether sensitive data or administrative functions could be affected. The notices provide limited public detail, but the combination of an information disclosure flaw and additional unspecified weaknesses raises concern for enterprises using Proxmox to host virtual machines and manage clustered infrastructure. Security teams should identify all PVE deployments, monitor vendor and CERT updates for affected versions and patches, and prioritize remediation or compensating controls on internet-reachable or business-critical systems.
Jun 29, 2026
QNAP has patched 14 vulnerabilities across **QTS**, **QuTS hero**, **QuTS cloud**, and **QVP** that affect NAS and surveillance appliances, with impacts ranging from denial of service and information disclosure to privilege escalation and remote code execution. The vendor’s advisory `QSA-26-10` describes multiple bug classes, including command injection, buffer overflow, broken access control, URL injection, NULL pointer dereference, and uncontrolled resource consumption, and rates the issues as **Important**. The most serious flaws include command injection vulnerabilities `CVE-2025-66273`, `CVE-2025-66279`, and `CVE-2026-22893`, which can allow arbitrary command execution through username handling or administrative APIs, including one privilege-escalation scenario. QNAP also fixed `CVE-2025-59382`, a password-reset URL manipulation issue that can expose credentials. Fixed releases include **QVP 2.8.0**, **QuTS cloud C5.2.9**, **QTS 5.2.9.3499**, and **QuTS hero h5.2.9**; administrators were urged to update immediately, avoid exposing management interfaces to the internet, and maintain snapshots and offline backups because internet-facing NAS devices are frequent ransomware targets.
Jun 29, 2026