Submitted 2 weeks ago by peppericecream@lemmy.dbzer0.com to selfhosted@lemmy.world
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1
The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
You mean watchtower by containrrr? That repo seems archived.
Also, if you don’t mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?
If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup if it really went wrong and I can’t recover otherwise.
Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.
I use one of the maintained forks of watchtower.
I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
Hopefully with a firewall
Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.
it becomes easier to understand when you look outside of your bubble for, like, a second.
if you want to try explaining to my eldery mother that lives 3000 miles away how to setup wireguard so she can access my jellyfin server on her smart tv, be my guest. oh you’ll just do it remotely? ok, explain to her how to install and setup vnc and forward the right ports so you can remote in, oh but she doesn’t want to watch on her laptop, she wants it on her tv. can’t vnc into that.
or you can say “install the plex app and here is your login.”
i’m a jellyfin user, but that’s why people continue to use plex.
I’m having a hard time understanding why you need all of that to just log into your jellyfin when you’re not home! You don’t need wireguard. That is something you chose to do for some reason. I can do it with literally the same way you said it
“install the plex app and i emailed you your login details.”
Replace plex with jellyfin. Your mother won’t need to do anything but downloading the app and putting in the credentials. Get a domain from cloudflare for $10 a year and set it up on the server. That’s it. No need for wireguard. I did the same thing for my friend who uses my jellyfin. I only sent him username and password. That’s it.
It just werks.
Because Jellyfin is an ugly, duct taped together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.
That’s subjective. I’ve never had an issue with it, neither has my wife or son or the couple of friends who use my media.
Not that I want to disagree with you, and I have never used Plex. But I was shocked how polished and easy Jellyfin is for an open source project when I used it the first time. It feels like a very mature piece of software to me. My gf really loves it.
I agree setting up tailscale for remote access was a bit of a learning curve though.
It’s easier to setup and use for less technical people, also just more widely known.
I run Jellyfin but logging in is a pain, have to manually enter the URL (including https for some crazy reason) and username and password using a crappy TV remote.
The difference in your comment between the two is only entering the URL, which is normally the first screen you are created with on jellyfin clients. you’re using the same crappy remote to enter the username password, no?
I have Plex and Jellyfin but if I want to watch on my PS5, Plex has an official media app on there that’s really convenient to use.
Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
Kind of defeats the purpose of Plex and Jellyfin.
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
If you don’t have ports open, you’re not an internet participant. You’re just spectating.
That’s pretty much the number one reason people say they won’t move to Jellyfin.
Even though exposing your shit to Internet is a terrible idea for most people.
Just throw a wireguard tunnel on your router and call it a day.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.
My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th… no doubt from dirtbags trying to exploit this.
Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the cert logs.
Thank god I have auto update for my exposed dockers…
Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.
Could you specify any of those issues? I ask because the only one I’m tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.
There have been a few major ones this year, I’m sure they are fixed at this point though. app.opencve.io/cve/?vendor=jellyfin
Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.
btw is passive agressive now?
How quit reading tone into words and grow up a little.
i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?
It’s always amazing at how many crawlers/pentest kits are hitting my well-known ports.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CSAM | Child Sexual Abuse Material |
| Plex | Brand of media server package |
| VPN | Virtual Private Network |
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
I got hit by this a couple days ago.
How did you detect and remove it
I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.
Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.
I got all worried and updated (I basically never do) and then went to put in my password to log back in and then go searching for files and whatever, and wouldn’t you know it I was smart as shit and made the password tell me in no uncertain terms that I changed it for exactly that problem!
I did it because I was annoyed at having to do it I’m sure, but man it turns out that was a great idea!
ExcessShiv@lemmy.dbzer0.com 2 weeks ago
Oh god, its the new Arch isn’t it…
Seralth@piefed.seralth.com 2 weeks ago
No nix is the new arch.
Lol
Nibodhika@lemmy.world 2 weeks ago
I used to use Arch, now I use Nix, so that checks out
numanair@lemmy.ml 2 weeks ago
Except it makes sense to use
whoisearth@lemmy.ca 2 weeks ago
I’m waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
ExcessShiv@lemmy.dbzer0.com 2 weeks ago
You will find them in their natural habitat, the crossfit/hyrox gym.
ThoGot@feddit.org 2 weeks ago
Apparently not using Arch is the only thing keeping me from reaching my peak in life
moodwrench@lemmy.world 2 weeks ago
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
pory@lemmy.world 2 weeks ago
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
VibeSurgeon@piefed.social 2 weeks ago
Jellyfin is based on the Emby-codebase before they relicensed it as closed source.
Nibodhika@lemmy.world 2 weeks ago
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that’s still possible though.
peppericecream@lemmy.dbzer0.com 2 weeks ago
I think it’s not a widely used phrase yet
ripcord@lemmy.world 2 weeks ago
It definitely is in this community
defaultusername@lemmy.dbzer0.com 2 weeks ago
So what you’re saying is that you’re using it before it’s cool…
DaveyRocket@lemmy.world 2 weeks ago
Idk, I think I heard peppe rice cream say it…
Psythik@lemmy.world 2 weeks ago
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library requires.
halcyoncmdr@piefed.social 2 weeks ago
Ah yes, the better option is to… use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.
curbstickle_lw@lemmy.world 2 weeks ago
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
electric_nan@lemmy.ml 2 weeks ago
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
keithnator3000@lemmy.world 2 weeks ago
I have everything locally and watch on VLC fwiw /s
DarkSirrush@piefed.ca 2 weeks ago
Now that is the arch of the self hosted streaming community.
Auli@lemmy.ca 2 weeks ago
Nope