Plex2Shell: Check the Running Server, Not Just the Docker Tag
Checked October 19, 2026. An “updated” label is not a security verdict. For a Plex server, record the software actually running, how it was deployed, and whether an earlier exposure needs investigation. This source-based guide is for administrators of their own servers, not a forensic diagnosis.
Start with the running version
Plex’s October 19 advisory update says these chained vulnerabilities are actively exploited and identifies 1.43.3.10861 and later as unaffected. In Plex Web, open Settings → General and record the server version. An older, internet-reachable installation may already be compromised; updating and investigating are separate tasks. Follow the current Plex advisory.
The calendar matters: Plex announced fixes September 1. A researcher’s October 17 honeypot report describes subsequent exploitation and acknowledges incomplete capture of some attacks. That observation does not measure all affected servers.
Three states that should not be confused
A useful audit has three boxes: image downloaded, intended container running, application version verified. Checking only the first leaves the other two unanswered.
Docker documents that Compose pull downloads service images without starting containers. Compose up can recreate a service when its image or configuration changes, preserving mounted volumes. That preservation is convenient for an ordinary update; it is not evidence that retained data is trustworthy after an incident.
For a routine update, an authorized operator should follow the image maintainer’s procedure, plan for downtime, and check the running application afterward. Do not copy a destructive cleanup command into an unfamiliar deployment.
Identify the image provider first
For plexinc/pms-docker, the official README gives public and beta tags a special startup-update behavior: they check for a Plex release when started or restarted. Do not generalize that behavior to every tag or image.
LinuxServer’s image has a separate VERSION setting. Its docker mode relies on the packaged application; latest and public have their own documented update choices. Its read-only and non-root modes do not support runtime application updating. Record the exact repository, tag and VERSION setting before choosing an update route.
An illustrative maintenance record might say: “image fetched successfully; service recreated; Plex Web now shows the expected build.” Keep the actual version and check time beside that statement. A remembered update date alone is weaker evidence.
Patching is not a clean bill of health
Plex advises checking suspicious processes, unexpected codec libraries and unexplained idle CPU/network activity. Where compromise is found or cannot be ruled out, its guidance includes a clean rebuild, account-session/password remediation and reviewing resources accessible to the service account. Consult the full advisory before recovery; preserve relevant evidence and seek qualified help where needed. Do not treat an absence of obvious symptoms as a forensic clearance.
Keep a separate incident record from the maintenance record. Who reviewed the earlier exposure? What evidence supports reopening access? Which questions remain unanswered? A completed update should not silently answer those questions.
Your private handoff checklist
- Repository, tag and relevant application-update setting.
- Running Plex version and time checked.
- Intended remote-access configuration.
- Evidence retained and person responsible for incident review.
- Next review time and unresolved questions.
Do not post logs containing tokens or private media paths publicly. Recheck the vendor advisory before restoring a service. This checklist improves the quality of a handoff; it does not certify a server safe.
Knowledge check
Check Your Update Assumptions
Sources — checked October 19, 2026
Plex security advisory — including October 19 update
Researcher's October 17 honeypot report
Docker documentation: Compose pull
Docker documentation: Compose up
Plex-maintained container README
LinuxServer Plex image documentation
