I can't recall if the article said it was an exploit in Plex itself that they patched. I don't run Plex so I didn't dig into the details.