The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
You must log in or register to comment.
- i_stole_ur_taco@lemmy.caEnglish20 days
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
20 daysThat kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
- ITGuyLevi@programming.devEnglish18 days
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
- ExcessShiv@lemmy.dbzer0.comEnglish20 days
Also I use Jellyfin btw.
Oh god, its the new Arch isn’t it…
I’m waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
- moodwrench@lemmy.worldEnglish20 days
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
- BakedCatboy@lemmy.mlEnglish20 days
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
- 17 days
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CSAM Child Sexual Abuse Material DNS Domain Name Service/System ISP Internet Service Provider LXC Linux Containers Plex Brand of media server package SMB Server Message Block protocol for file and printer sharing; Windows-native UDP User Datagram Protocol, for real-time communications VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network nginx Popular HTTP server
10 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
- 20 days
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
- Encrypt-Keeper@lemmy.worldEnglish19 days
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
- heartSagan5@lemmy.zipEnglish20 days
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
- hereiamagain@sh.itjust.worksEnglish20 days
Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?
Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there’s some config I’d have to do again and I don’t want to
- 20 days
I was also impacted, you need to remove the payload that got dumped:
Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid
Two processes named khungtaskd / cron
They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.
Then you can reclaim ownership and it resets the admin token.
You should likely be fine, I didn’t have any crypto miners on mine, it was just in a docker instance and didn’t have access outside of it. I would be much more worried if it was a direct install on a main PC.
Also install watch tower
- slash65@lemmy.worldEnglish20 days
Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.
- frongt@lemmy.zipEnglish20 days
It was forked months ago and is actively developed https://github.com/nicholas-fedor/watchtower/
Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.
- Encrypt-Keeper@lemmy.worldEnglish19 days
Because Jellyfin is an ugly, duct-taped-together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.
Invariably whenever you bring any of these issues up, people will come out of the woodwork and tell you “Oh you just have to bolt this thing on or use it in this one specific unintended way in order to get it working halfway towards what you want”.
- heartSagan5@lemmy.zipEnglish20 days
Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.
- NewNewAugustEast@lemmy.zipEnglish19 days
btw is passive agressive now?
How about quit reading tone into words and grow up a little.
- frongt@lemmy.zipEnglish20 days
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
- sanpo@sopuli.xyzEnglish20 days
That’s pretty much the number one reason people say they won’t move to Jellyfin - the ease of public access.
Even though exposing your shit to Internet is a terrible idea for most people.
- 20 days
Just throw a wireguard tunnel on your router and call it a day.
If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.
- lama@lemmy.worldEnglish20 days
WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people
I manage it with netbird.
Just have em install netbird, if it’s on they can connect to my website. If it’s off they can’t.
It’s literally three steps for each person, there’s ways to make this easy. It just requires the host to put in the leg work
- Auli@lemmy.caEnglish20 days
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
- frongt@lemmy.zipEnglish20 days
Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.
- 20 days
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
