On October 16, 2026, researcher Zach Main published Plex2Shell, a chain of four flaws — CVE-2026-96652, 96654, 96655 and 96656 — enabling unauthenticated remote code execution on Plex Media Server. By October 17, attackers were deploying an XMRig miner and a residential proxy on exposed servers: update to 1.43.3.10861 and take Plex off the public internet.
On September 15, 2026, Plex shipped two Plex Pass audio options: Boost Dialog, which lifts the frequencies where voices live, and Normalize Loudness, which evens out volume swings. The loudness analysis that powers them runs on your CPU during maintenance, so measure the cost before you turn it on for a large library.
Plex ships Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to close several flaws whose CVEs have not yet been published, while Censys counts more than 360,000 web interfaces exposed to the internet. Update server and clients, and check your NAS update channel, which can lag behind.
Floppy, an AGPL-3.0 self-hosted media tracker, brings movies, TV, anime, books, games, music and podcasts into one library, with sync for Plex, Jellyfin, Audiobookshelf and Pocket Casts. Anyone who wants their watch history back on their own hardware can run it on a Docker container and a Redis instance.
In early August 2026, Trakt began requiring a $4.99/month VIP subscription to create API applications, and existing keys are vanishing. The self-hosted ecosystem that syncs Plex, Jellyfin and Kodi with Trakt is discovering its dependence on a third-party service that is no longer free.
On April 29, 2025, Plex doubled its lifetime price to $249.99 and killed free remote streaming. One year later, Jellyfin has crossed 50,000 GitHub stars, 360 million Docker pulls, and 51% market share among self-hosters. If you own a server and a media collection, paying to stream it no longer makes sense.
