Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger.  Skip to "In the wild exploitati...

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

  • bretton.dev@coves.social
    9·
    3 days ago

    I was also impacted, you need to remove the payload that got dumped:

    Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid

    Two processes named khungtaskd / cron

    They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.

    Then you can reclaim ownership and it resets the admin token.

    You should likely be fine, I didn’t have any crypto miners on mine, it was just in a docker instance and didn’t have access outside of it. I would be much more worried if it was a direct install on a main PC.

    Also install watch tower

    • slash65@lemmy.worldEnglish
      9·
      3 days ago

      Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.

      • RxBrad@infosec.pubEnglish
        1·
        12 hours ago

        I used the nicholas-fedor Watchtower branch for a while.

        I use Dockhand now (switched to it when Portainer accounced their enshittification), and that has auto-update built-in. So I no longer needed Watchtower.

        I believe Arcane also has auto-update, since Dockhand has hinted at their own enshittification a few years from now…

      • BakedCatboy@lemmy.mlEnglish
        2·
        3 days ago

        Yeah good call. I keep using an actively maintained fork because I can’t be bothered to switch to another project.

    • hereiamagain@sh.itjust.worksEnglish
      1·
      2 days ago

      I checked tmp, and looked for suspicious processes or cron jobs, checked logs, I don’t see any reason to think I was impacted.

      So that’s good.