The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
I got all worried and updated (I basically never do) and then went to put in my password to log back in and then go searching for payload files and whatever, and wouldn’t you know it I was smart as shit and made the password tell me in no uncertain terms that I changed it for exactly that problem! Could stop worrying!
I did it because I was annoyed at having to do it I’m sure, but man it turns out that was a great idea!
Also I use Jellyfin btw.
Oh god, its the new Arch isn’t it…
No nix is the new arch.
Lol
I used to use Arch, now I use Nix, so that checks out
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
Jellyfin is based on the Emby-codebase before they relicensed it as closed source.
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that’s still possible though.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
But I haven’t paid anything to Emby (I don’t need the code behind that key) and without cloud, I could continue using this version forever and they can’t enshitify it
Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.
I just stream over SMB, much less fuckery tbh.
I think it’s not a widely used phrase yet
So what you’re saying is that you’re using it before it’s cool…
It definitely is in this community
Idk, I think I heard peppe rice cream say it…
I have everything locally and watch on VLC fwiw /s
Now that is the arch of the self hosted streaming community.
If VLC is arch, what is MPV?
BSD
And MPC is Windows?
I can only vouch for old mpc and i think i remember it being clunky but decent. It’s been a very long time though
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.
Ah yes, the better option is to… use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
Nuvio is the same as Stremio except better, because it has more quality of life features (like a “Who’s watching” feature). I only mentioned Stremio because it’s more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it’s more like that.
Yeah I loved popcorn time. I’m looking into Stremio, and I’m already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn’t seem like anything I can recommend to nontechnical folks.
Well like I said, please look into Nuvio instead. I’m about to ditch Stremio and switch
Nope
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?
pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.
It’s always amazing at how many crawlers/pentest kits are hitting my well-known ports.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CSAM Child Sexual Abuse Material Plex Brand of media server package SMB Server Message Block protocol for file and printer sharing; Windows-native VPN Virtual Private Network
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?
Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there’s some config I’d have to do again and I don’t want to
I was also impacted, you need to remove the payload that got dumped:
Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid
Two processes named khungtaskd / cron
They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.
Then you can reclaim ownership and it resets the admin token.
You should likely be fine, I didn’t have any crypto miners on mine, it was just in a docker instance and didn’t have access outside of it. I would be much more worried if it was a direct install on a main PC.
Also install watch tower
Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.
It was forked months ago and is actively developed https://github.com/nicholas-fedor/watchtower/
Yeah good call. I keep using an actively maintained fork because I can’t be bothered to switch to another project.
How fuxked am I if my plex is running on unraid
I got hit by this a couple days ago.
How did you detect and remove it
I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.
Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.
Did you reset your Plex admin keys?
Yeah, in the logs I saw they seemed to get my keys so I reset everything
Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
EDIT:
Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031
Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.
And please run inside a non privliged container. Either use uidmap or go rootless.
I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
Hopefully with a firewall
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
behold! the jellyfin community in a nutshell.
I don’t use jellyfin.
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
Kind of defeats the purpose of Plex and Jellyfin.
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
How do I get my grandparents tv on a vpn
You could put a Site2Site VPN on their router and your router. Bonus points if you use firewall rules to allow only your media server instead of your whole network.
Sir, this is /c/selfhosted.
That’s pretty much the number one reason people say they won’t move to Jellyfin - the ease of public access.
Even though exposing your shit to Internet is a terrible idea for most people.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.
Not if your Jellyfin is set up correctly.
Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
Just throw a wireguard tunnel on your router and call it a day.
If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.
That’s fine for your personal remote access but that doesn’t help your 80 year old mother in law watch videos of the grandchildren on a Roku.
Been thinking of throwing together a set top box with everything made up for my grandfather so he can stream stuff from my jellyfin setup.
I just need to find an ezpz enough to use frontend.
Slap a vpn on her computer or but a shitty dell from good will. Point the Roku at that and forward the traffic…?
Like this is a solvable setup and forget about it for the next 5 years. Sort of set up.
WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people
I manage it with netbird.
Just have em install netbird, if it’s on they can connect to my website. If it’s off they can’t.
It’s literally three steps for each person, there’s ways to make this easy. It just requires the host to put in the leg work
It’s really not. If people are too lazy to install one VPN app and import the tunnel config, then they can pay for paid streaming instead.
