Plex2Shell: old Plex Media Server builds are being exploited for unauthenticated RCE
Four Plex Media Server bugs chain into unauthenticated remote code execution in builds before 1.43.3.10861. Plex announced the fix in September, a public proof of concept landed on 16 October, and one researcher's honeypot logged exploitation the next morning.