More than 36,000 Plex Media servers that are reachable over the internet have not been patched against known security flaws. These are not theoretical weaknesses — they are documented vulnerabilities with fixes already available. The patches exist. A large number of users simply have not applied them.
What happened
Researchers identified over 36,000 publicly exposed Plex Media Server installations still running versions affected by known security vulnerabilities. That number is not a small rounding error. It represents a substantial share of all Plex servers that can be reached from the open internet.
The word “exposed” here means the server is reachable by anyone on the internet, not just people on your home network. Security researchers and attackers both scan the internet routinely for software with known weaknesses. A server does not need to be advertised anywhere to be found this way.
Patches have been released. The gap between “fix available” and “fix applied” is where the risk lives.
Who is affected
If you run a Plex Media Server, have remote access switched on, and have not updated the software recently, you may be among the 36,000.
This matters especially to individual creators, freelancers, and small studio operators who self-host their media rather than paying for a third-party streaming platform. Self-hosting means you control your own files — but it also means you are responsible for your own security.
People who set up Plex a while ago and left it running on a spare machine or a network-attached storage device (a small box that stores files on your home or office network) are particularly exposed. Software left on autopilot falls behind.
If you share your server with collaborators, clients, or family members, they are also part of the picture. Whatever an attacker can do once inside, they can do to anything those accounts touch.
What the real risk is
For many creators, a Plex server holds more than films to watch on a Friday night. It can contain raw footage, recorded interviews, unreleased music, draft edits, and original work that has real intellectual property value — work you have not published yet and may not want anyone else to see.
A Plex server security vulnerability that goes unpatched gives an attacker a potential path to the files stored on or accessible through that server. That could mean copying unreleased work before you release it, deleting files, or simply reading what is there.
The damage does not necessarily stop at Plex. A compromised server sitting on your home or studio network can become a way in to other devices on the same connection — your laptop, your backup drives, other machines. The breach widens.
There is also a personal data dimension. Plex accounts are linked to email addresses and usage data. A server-level compromise can expose information that builds a broader picture of who you are and what you own.
Whether attackers have already actively exploited these specific servers, and what they may have done, has not been disclosed in the source reporting.
What to do today
These steps are achievable this week, even if you are not technical.
1. Check your version and update
Open your Plex Media Server dashboard — usually found by going to app.plex.tv in a browser or opening the Plex app on the machine running your server. Look for a version number, often shown in the settings or at the bottom of the dashboard. Then go to the official Plex website (plex.tv) and find the latest release version listed there. If your number is lower, download and install the update immediately.
2. Turn off remote access if you do not need it
Remote access means your server can be reached from outside your home or studio network — from a café, from a client’s office, from anywhere. If you do not actually use that feature, turn it off. In Plex settings, go to Settings → Remote Access and disable it. Removing the exposure is the fastest way to reduce the risk.
3. Review who has access
Go through the list of user accounts that can access your server. Remove anyone who no longer needs it — a collaborator from a finished project, a family member who moved away, anyone you added and forgot about. Fewer accounts means fewer ways in.
4. Check your router or firewall settings
Plex uses specific network ports (numbered pathways through your router) to communicate. If you are not sure whether your router is blocking unsolicited incoming connections on those ports, contact whoever set up your network, or call your internet provider. You do not need to understand the technical detail — just ask: “Is my router blocking incoming connections I did not ask for?”
5. Back up your original work offline
Copy any original creative files stored on or accessible through your Plex setup to a separate location that is not connected to the internet — an external hard drive kept unplugged, for example. Even a worst-case compromise cannot permanently destroy work that exists somewhere else.
Why this keeps happening
Self-hosted software puts the entire update responsibility on the person running it. Most people install a tool, get it working, and move on. Updates feel optional until something breaks.
Plex in particular tends to be set up once and forgotten. It runs quietly in the background on a machine that does not get daily attention. That is precisely the kind of software that falls behind.
But there is a deeper problem here that goes beyond update habits. When you self-host creative work and that server is connected to the internet without proper controls, your files exist in a space where ownership is technically asserted but practically unverifiable. There is no reliable mechanism built into the open internet to tie a file, a folder, or a server to a specific accountable person. Attackers do not need to prove anything — they just need access. Once they have it, your unpublished work, your recorded interviews, your raw footage, can move across the network with no trace of who took it or who now holds it. Platforms and data brokers operate in the same gap: because ownership online is so hard to verify and enforce in practice, whoever controls the data tends to claim the rights to it by default. Leaving a server unpatched is not just a technical oversight — it is handing that ambiguity to whoever finds the door open first.
Until automatic, enforced updates become standard for self-hosted tools, the window between a patch being released and users applying it will remain a predictable opportunity for anyone scanning for vulnerable software.
Frequently asked questions
Do I need to worry about this if my Plex server is only on my home network and not set to allow remote access?
If remote access is genuinely disabled and your server cannot be reached from outside your home network, your exposure to this specific issue is significantly lower. The 36,000 servers identified were publicly reachable from the internet. That said, it is still worth updating, because vulnerabilities can sometimes be reached in other ways, and keeping software current is good practice regardless.
Can attackers actually steal the creative files stored on my Plex server, or can they only watch my media?
What an attacker can access depends on how your server and network are configured, and on the specific nature of the vulnerability involved. In general, gaining unauthorised access to a server can mean more than just viewing media — it can potentially mean copying, deleting, or reading any files the server has access to. The full details of what these specific vulnerabilities allow has not been disclosed in the source reporting.
If my Plex server was already compromised, what should I do about my intellectual property?
First, disconnect the affected machine from the internet and change all passwords associated with your Plex account and any accounts on the same network. Document what files were stored there and when you last had confirmed control of them. If you believe original, unpublished work has been copied or distributed without your permission, how that is handled — and what remedies exist — varies by country and by the specifics of what was taken. Consult a lawyer who handles intellectual property matters in your jurisdiction before taking further action.
Originally reported by bleepingcomputer.com. This article summarises that reporting and adds practical guidance.
Scams, fraud, bots and manufactured noise keep spreading because the internet was built with no reliable way to know who anyone actually is. Everyone deserves authenticity and accountability online, and that is the mission we are working on. Subscribe to stay informed as this space develops.
This article is general information, not legal advice. Laws differ by country — consult a qualified lawyer about your situation.
