Submitted 6 hours ago by peppericecream@lemmy.dbzer0.com to selfhosted@lemmy.world
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CSAM | Child Sexual Abuse Material |
| Plex | Brand of media server package |
| VPN | Virtual Private Network |
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
mlg@lemmy.world 2 hours ago Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
Hopefully with a firewall
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
Kind of defeats the purpose of Plex and Jellyfin.
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
Seralth@piefed.seralth.com 2 hours ago The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
If you don’t have ports open, you’re not an internet participant. You’re just spectating.
That’s pretty much the number one reason people say they won’t move to Jellyfin.
Even though exposing your shit to Internet is a terrible idea for most people.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Just throw a wireguard tunnel on your router and call it a day.
I got hit by this a couple days ago.
How did you detect and remove it
Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?
I was also impacted, you need to remove the payload that got dumped:
Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid
Two processes named khungtaskd / cron
They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.
Then you can reclaim ownership and it resets the admin token.
You should likely be fine, I didn't have any crypto miners on mine, it was just in a docker instance and didn't have access outside of it. I would be much more worried if it was a direct install on a main PC.
Also install watch tower
Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.
How fuxked am I if my plex is running on unraid
ExcessShiv@lemmy.dbzer0.com 5 hours ago
Oh god, its the new Arch isn’t it…
Psythik@lemmy.world 1 hour ago
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library requires.
curbstickle_lw@lemmy.world 23 minutes ago
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
electric_nan@lemmy.ml 35 minutes ago
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
@Psythik Never heard of it, what's the license?
@ExcessShiv
No nix is the new arch.
Lol
moodwrench@lemmy.world 1 hour ago
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
peppericecream@lemmy.dbzer0.com 4 hours ago
I think it’s not a widely used phrase yet
Idk, I think I heard peppe rice cream say it…
ripcord@lemmy.world 50 minutes ago
It definitely is in this community
keithnator3000@lemmy.world 3 hours ago
I have everything locally and watch on VLC fwiw /s
DarkSirrush@piefed.ca 3 hours ago
Now that is the arch of the self hosted streaming community.
Auli@lemmy.ca 4 hours ago
Nope