Submitted 3 weeks ago by peppericecream@lemmy.dbzer0.com to selfhosted@lemmy.world
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
CatLikeLemming@lemmy.blahaj.zone 2 weeks ago You mean watchtower by containrrr? That repo seems archived.
Also, if you don’t mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?
MangoPenguin@lemmy.blahaj.zone 2 weeks ago If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup if it really went wrong and I can’t recover otherwise.
Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.
I use one of the maintained forks of watchtower.
I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
mlg@lemmy.world 3 weeks ago Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
Hopefully with a firewall
richardisaguy@lemmy.world 3 weeks ago Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
How’d that make money?
Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.
it becomes easier to understand when you look outside of your bubble for, like, a second.
if you want to try explaining to my eldery mother that lives 3000 miles away how to setup wireguard so she can access my jellyfin server on her smart tv, be my guest. oh you’ll just do it remotely? ok, explain to her how to install and setup vnc and forward the right ports so you can remote in, oh but she doesn’t want to watch on her laptop, she wants it on her tv. can’t vnc into that.
or you can say “install the plex app and here is your login.”
i’m a jellyfin user, but that’s why people continue to use plex.
I’m having a hard time understanding why you need all of that to just log into your jellyfin when you’re not home! You don’t need wireguard. That is something you chose to do for some reason. I can do it with literally the same way you said it
“install the plex app and i emailed you your login details.”
Replace plex with jellyfin. Your mother won’t need to do anything but downloading the app and putting in the credentials. Get a domain from cloudflare for $10 a year and set it up on the server. That’s it. No need for wireguard. I did the same thing for my friend who uses my jellyfin. I only sent him username and password. That’s it.
Some paid for lifetime and enjoy it. Or prefer the layout. Or prefer the easier sharing if data with family and friends.
There are still reasons to run Plex over Jellyfin for some, but not many if they keep going the way they are.
Understandable, but like I told the other person in another comment. Setting jellyfin on a friend’s device is as easy as setting up plex if you get a domain name. I have one from cloudflare that I pay $10 a month for. I create the user account on my end and only give my friend the server address and login
It just werks.
Because Jellyfin is an ugly, duct taped together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.
That’s subjective. I’ve never had an issue with it, neither has my wife or son or the couple of friends who use my media.
Not that I want to disagree with you, and I have never used Plex. But I was shocked how polished and easy Jellyfin is for an open source project when I used it the first time. It feels like a very mature piece of software to me. My gf really loves it.
I agree setting up tailscale for remote access was a bit of a learning curve though.
MangoPenguin@lemmy.blahaj.zone 2 weeks ago It’s easier to setup and use for less technical people, also just more widely known.
I run Jellyfin but logging in is a pain, have to manually enter the URL (including https for some crazy reason) and username and password using a crappy TV remote.
The difference in your comment between the two is only entering the URL, which is normally the first screen you are created with on jellyfin clients. you’re using the same crappy remote to enter the username password, no?
I have Plex and Jellyfin but if I want to watch on my PS5, Plex has an official media app on there that’s really convenient to use.
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
Kind of defeats the purpose of Plex and Jellyfin.
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
seralth@piefed.seralth.com@piefed.seralth.com 3 weeks ago The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
If you don’t have ports open, you’re not an internet participant. You’re just spectating.
That’s pretty much the number one reason people say they won’t move to Jellyfin.
Even though exposing your shit to Internet is a terrible idea for most people.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Just throw a wireguard tunnel on your router and call it a day.
Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?
I was also impacted, you need to remove the payload that got dumped:
Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid
Two processes named khungtaskd / cron
They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.
Then you can reclaim ownership and it resets the admin token.
You should likely be fine, I didn't have any crypto miners on mine, it was just in a docker instance and didn't have access outside of it. I would be much more worried if it was a direct install on a main PC.
Also install watch tower
Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.
I checked tmp, and looked for suspicious processes or cron jobs, checked logs, I don’t see any reason to think I was impacted.
So that’s good.
How fuxked am I if my plex is running on unraid
RxBrad@infosec.pub 3 weeks ago My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.
My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th… no doubt from dirtbags trying to exploit this.
MangoPenguin@lemmy.blahaj.zone 2 weeks ago Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the cert logs.
Thank god I have auto update for my exposed dockers…
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CSAM | Child Sexual Abuse Material |
| Plex | Brand of media server package |
| VPN | Virtual Private Network |
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
MangoPenguin@lemmy.blahaj.zone 2 weeks ago Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.
Could you specify any of those issues? I ask because the only one I’m tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.
Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.
btw is passive agressive now?
How quit reading tone into words and grow up a little.
i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?
It’s always amazing at how many crawlers/pentest kits are hitting my well-known ports.
I got hit by this a couple days ago.
How did you detect and remove it
I got all worried and updated (I basically never do) and then went to put in my password to log back in and then go searching for files and whatever, and wouldn’t you know it I was smart as shit and made the password tell me in no uncertain terms that I changed it for exactly that problem!
I did it because I was annoyed at having to do it I’m sure, but man it turns out that was a great idea!
ExcessShiv@lemmy.dbzer0.com 3 weeks ago
Oh god, its the new Arch isn’t it…
No nix is the new arch.
Lol
Nibodhika@lemmy.world 3 weeks ago
I used to use Arch, now I use Nix, so that checks out
numanair@lemmy.ml 3 weeks ago
Except it makes sense to use
whoisearth@lemmy.ca 3 weeks ago
I’m waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
ExcessShiv@lemmy.dbzer0.com 3 weeks ago
You will find them in their natural habitat, the crossfit/hyrox gym.
ThoGot@feddit.org 2 weeks ago
Apparently not using Arch is the only thing keeping me from reaching my peak in life
moodwrench@lemmy.world 3 weeks ago
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
VibeSurgeon@piefed.social 3 weeks ago
Jellyfin is based on the Emby-codebase before they relicensed it as closed source.
Nibodhika@lemmy.world 3 weeks ago
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that’s still possible though.
peppericecream@lemmy.dbzer0.com 3 weeks ago
I think it’s not a widely used phrase yet
ripcord@lemmy.world 3 weeks ago
It definitely is in this community
defaultusername@lemmy.dbzer0.com 3 weeks ago
So what you’re saying is that you’re using it before it’s cool…
Idk, I think I heard peppe rice cream say it…
Psythik@lemmy.world 3 weeks ago
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library requires.
halcyoncmdr@piefed.social 3 weeks ago
Ah yes, the better option is to… use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.
curbstickle_lw@lemmy.world 3 weeks ago
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
electric_nan@lemmy.ml 3 weeks ago
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
@Psythik Never heard of it, what's the license?
@ExcessShiv
keithnator3000@lemmy.world 3 weeks ago
I have everything locally and watch on VLC fwiw /s
DarkSirrush@piefed.ca 3 weeks ago
Now that is the arch of the self hosted streaming community.
Auli@lemmy.ca 3 weeks ago
Nope