Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger.  Skip to "In the wild exploitati...

The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

  • flandish@lemmy.worldEnglish
    1·
    3 hours ago

    i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?

    pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.

  • Richard@lemmy.worldEnglish
    2·
    5 hours ago

    Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.

    • moodwrench@lemmy.worldEnglish
      31·
      7 hours ago

      Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.

      • pory@lemmy.worldEnglish
        171·
        7 hours ago

        The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.

        • moodwrench@lemmy.worldEnglish
          21·
          6 hours ago

          But I haven’t paid anything to Emby (I don’t need the code behind that key) and without cloud, I could continue using this version forever and they can’t enshitify it

          • techwithjake@sh.itjust.worksEnglish
            5·
            4 hours ago

            Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.

    • Psythik@lemmy.worldEnglish
      32·
      7 hours ago

      IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

      • curbstickle_lw@lemmy.worldMEnglish
        5·
        6 hours ago

        Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.

        There are many reasons. Dont assume your use case is the only one.

      • electric_nan@lemmy.mlEnglish
        2·
        6 hours ago

        I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.

        • Psythik@lemmy.worldEnglish
          1·
          6 hours ago

          Nuvio is the same as Stremio except better, because it has more quality of life features (like a “Who’s watching” feature). I only mentioned Stremio because it’s more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it’s kinda like that.

          • electric_nan@lemmy.mlEnglish
            2·
            5 hours ago

            Yeah I loved popcorn time. I’m looking into Stremio, and I’m already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn’t seem like anything I can recommend to nontechnical folks.

            • Psythik@lemmy.worldEnglish
              2·
              5 hours ago

              Well like I said, please look into Nuvio instead. I’m about to ditch Stremio and switch

  • i_stole_ur_taco@lemmy.caEnglish
    161·
    10 hours ago

    Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.

    A vulnerability? No…. 4 of them. And they stack.

  • BakedCatboy@lemmy.mlEnglish
    10·
    11 hours ago

    As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low

  • mlg@lemmy.worldEnglish
    75·
    8 hours ago

    Also I use Jellyfin btw.

    You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao

    • non_burglar@lemmy.worldEnglish
      66·
      7 hours ago

      I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??

      • GreenKnight23@lemmy.worldEnglish
        31·
        4 hours ago

        Also I use Jellyfin btw.

        You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao

        I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??

        behold! the jellyfin community in a nutshell.

        1000004739

      • Gwaer@lemmy.worldEnglish
        1·
        4 hours ago

        I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.

        Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.

  • hereiamagain@sh.itjust.worksEnglish
    3·
    11 hours ago

    Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?

    Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there’s some config I’d have to do again and I don’t want to