Link: https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html?m=1

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?

Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there's some config I'd have to do again and I don't want to

As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low

Also I use Jellyfin btw.

Oh god, its the new Arch isn't it...

I'm guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.

That's pretty much the number one reason people say they won't move to Jellyfin - the ease of public access.

Even though exposing your shit to Internet is a terrible idea for most people.

Nope

Kind of defeats the purpose of Plex and Jellyfin.

I think people over blow how dangerous it is. Or maybe its better most people dont. I don't know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.

And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.

Just throw a wireguard tunnel on your router and call it a day.

If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.

Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.

I was also impacted, you need to remove the payload that got dumped:

Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid

Two processes named khungtaskd / cron

They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.

Then you can reclaim ownership and it resets the admin token.

You should likely be fine, I didn't have any crypto miners on mine, it was just in a docker instance and didn't have access outside of it. I would be much more worried if it was a direct install on a main PC.

Also install watch tower

Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.

A vulnerability? No…. 4 of them. And they stack.

*defeats your purpose of Plex and Jellyfin

I just want a media server. I have no use case to make it available to the public internet.

I think it's not a widely used phrase yet

That's fine for your personal remote access but that doesn't help your 80 year old mother in law watch videos of the grandchildren on a Roku.

I have everything locally and watch on VLC fwiw /s

How fuxked am I if my plex is running on unraid

That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.

Now that is the arch of the self hosted streaming community.

If VLC is arch, what is MPV?

WG works for us, but isn't scalable once it comes to sharing. It would provide too much friction for a lot of people

Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.

BSD

It was forked months ago and is actively developed https://github.com/nicholas-fedor/watchtower/

Yeah good call. I keep using an actively maintained fork because I can't be bothered to switch to another project.

No nix is the new arch.

Lol

The only reason to expose it raw to the internet is because your hosting a piracy service.

You can easily keep everything inside of a wireguard VPN and expose nothing directly.

Slap a vpn on her computer or but a shitty dell from good will. Point the Roku at that and forward the traffic...?

Like this is a solvable setup and forget about it for the next 5 years. Sort of set up.

Sir, this is /c/selfhosted.

I manage it with netbird.

Just have em install netbird, if it's on they can connect to my website. If it's off they can't.

It's literally three steps for each person, there's ways to make this easy. It just requires the host to put in the leg work

I got hit by this a couple days ago.

It's really not. If people are too lazy to install one VPN app and import the tunnel config, then they can pay for paid streaming instead.

Also I use Jellyfin btw.

You shouldn't be talking with the amount of hilarious CVEs jellyfin has also had lmao

EDIT:

Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031

Your downvotes are meaningless, please don't run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.

And please run inside a non privliged container. Either use uidmap or go rootless.

I'm pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.

How do I get my grandparents tv on a vpn

Everyone talks about Jellyfin, but I just switched to Emby and I couldn't be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.

The main reason is that if you switch from Plex to Emby you're going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It's like when everyone finally dropped Skype and moved to... Discord. Which hey it's closed source and owned by venture capital, but it doesn't suck yet!!! And now in 2026, Discord is what Discord is.

And MPC is Windows?

IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

@Psythik Never heard of it, what's the license?@ExcessShiv

If you want to expose plex to the open Internet (not a VPN) Don't open the plex port to the internet. Turn off the "remote access" setting and run it behind a reverse proxy instead.

And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.

What license? Like Jellyfin, It's for piracy. Basically every streaming service combined into one. It relies on torrents, cached torrents, and Usenet find you the fastest way to instantly steam anything you want.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

10 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

[Thread #141 for this comm, first seen 19th Oct 2026, 23:00]
[FAQ] [Full list] [Contact] [Source code]

Not if your Jellyfin is set up correctly.

Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

It definitely is in this community

How did you detect and remove it

But I haven't paid anything to Emby (I don't need the code behind that key) and without cloud, I could continue using this version forever and they can't enshitify it