Plex patched this in August. Attacks started on 17 October, the day after somebody published the exploit
2026-10-20Security
Four chained flaws give unauthenticated code execution on a Plex Media Server. The fix shipped on 3 August and the attacks began seventy-five days later, which tells you the patch was never the variable.