The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
If you want to expose plex to the open Internet (not a VPN) Don’t open the plex port to the internet. Turn off the “remote access” setting and run it behind a reverse proxy instead.
And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.
Jellyfin has plenty of issues with public instances too. It’s just the reality of exposing to the public internet, unless it’s something that has a lot of dedicated work going into security it’s going to have problems.
Could you specify any of those issues? I ask because the only one I’m tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.
There have been a few major ones this year, I’m sure they are fixed at this point though. https://app.opencve.io/cve/?vendor=jellyfin
Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.
My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th… no doubt from dirtbags trying to exploit this.
Wildcard SSL does help a lot, since every subdomain isn’t broadcast publicly in the issuer logs.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CSAM Child Sexual Abuse Material DNS Domain Name Service/System ISP Internet Service Provider LXC Linux Containers Plex Brand of media server package SMB Server Message Block protocol for file and printer sharing; Windows-native UDP User Datagram Protocol, for real-time communications VNC Virtual Network Computing for remote desktop access VPN Virtual Private Network nginx Popular HTTP server
10 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.
[Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]
i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?
pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.
It’s always amazing at how many crawlers/pentest kits are hitting my well-known ports.
I got hit by this a couple days ago.
How did you detect and remove it
I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.
Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.
Did you reset your Plex admin keys?
Yeah, in the logs I saw they seemed to get my keys so I reset everything
What are admin keys that you’re referring to?
They’re cryptographic strings that plex uses to identify you on the back end. You reset them by changing your password and checking the sign out all devices button.
Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.
it becomes easier to understand when you look outside of your bubble for, like, a second.
if you want to try explaining to my eldery mother that lives 3000 miles away how to setup wireguard so she can access my jellyfin server on her smart tv, be my guest. oh you’ll just do it remotely? ok, explain to her how to install and setup vnc and forward the right ports so you can remote in, oh but she doesn’t want to watch on her laptop, she wants it on her tv. can’t vnc into that.
or you can say “install the plex app and i emailed you your login details.”
i’m a jellyfin user, but that’s why people continue to use plex.
I’m having a hard time understanding why you need all of that to just log into your jellyfin when you’re not home! You don’t need wireguard, or VNC or any of that jargon. That is something you chose to do for some reason. I can do it with literally the same way you said it
“install the plex app and i emailed you your login details.”
Replace plex with jellyfin. Your mother won’t need to do anything but downloading the app and put in the credentials and the server address which is in your face once you launched the app. Get a domain from cloudflare for $10 a year and set it up on the server. That’s it. No need for wireguard. I did the same thing for my friend who uses my jellyfin. I only sent him username and password and server address. That’s it.
Plex is a bit more abstracted behind their services and auth, jellyfin runs exposed on the public internet in your case, I’m not willing to do that at present.
Some paid for lifetime and enjoy it. Or prefer the layout. Or prefer the easier sharing if data with family and friends.
There are still reasons to run Plex over Jellyfin for some, but not many of they keep going the way they are.
Understandable, but like I told the other person in another comment. Setting jellyfin on a friend’s device is as easy as setting up plex if you get a domain name. I have one from cloudflare that I pay $10 a month for. I create the user account on my end and only give my friend the server address and login
Sure, but I’ll use myself as an example: I don’t want any of my services exposed to the internet, so Tailscale/Netbird/other Wireguard solution is the best choice.
Some family members have their TV’s online with no Tailscale or media box, so that solution is out.Sure I could route all their Jellyfin traffic to my me via an exit node or VPN, but then we’re way deeper into this than my 60-something mother would ever want to. And I am on the hook for both her and my uptime. So phone/tablet/PC only if they don’t want a streaming device with native support.
The built in functionality on Plex is really practical, and practical is good for us creatures of comfort.
So I’m not disagreeing with you, just explaining what edge Plex still has over JF.
(And yes, I could do what you do and run with Cloudflare, but I don’t want to pay for it and I don’t want any traffic via third party I don’t trust)
Because Plexamp is by far the best music player I’ve ever used.
That’s fair. I don’t use it, so I don’t know what I’m missing. Navidrome has been fantastic. And it has great frontends on both IOS and Android. I’ve personally built my own frontend that I’ve been using for the better part of a year.
The lack of AirPlay 2, and the indignant dismissal by the lead developer when challenged on its omission, calls into question their technical comprehension and competency. That was around 5 years ago, and it’s still not been implemented.
It just werks.
It’s easier to setup and use for less technical people, also just more widely known.
I run Jellyfin but logging in is definitely a pain, have to manually enter the URL (including https:// for some crazy reason, why doesn’t it just default to it??) and username and password using a crappy TV remote.
The difference in your comment between the two is only entering the URL, which is normally the first screen you are created with on jellyfin clients. you’re using the same crappy remote to enter the username password, no?
Plex uses a code signin system where you open the app on your phone or just a browser, and enter the code there.
So there’s no typing/entering anything on the TV at all.
Jellyfin has “Quick Connect” that does the same thing
I have Plex and Jellyfin but if I want to watch on my PS5, Plex has an official media app on there that’s really convenient to use.
Because Jellyfin is an ugly, duct-taped-together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.
Invariably whenever you bring any of these issues up, people will come out of the woodwork and tell you “Oh you just have to bolt this thing on or use it in this one specific unintended way in order to get it working halfway towards what you want”.
Not that I want to disagree with you, and I have never used Plex. But I was shocked how polished and easy Jellyfin is for an open source project when I used it the first time. It feels like a very mature piece of software to me. My gf really loves it, too.
I agree setting up tailscale for remote access was a bit of a learning curve though.
If you think there’s anything polished about Jellyfin there’s a whole world of open source projects out there for you to discover. The world is your oyster.
It definitely isn’t mature by any measure. It’s been stuck in the process of fixing technical debt and poor design decisions from the project it was forked from for years now and still isn’t finished, though they’ve made some progress in the last couple years. But I’m not sure if they are going to keep the momentum up since several lead maintainers have left the project recently. Jellyfin still hasn’t figured out table stakes features like native intro and credit skipping, OIDC support, etc. There are some devastating bugs that having been around more most of its lifetime too. One they fixed like a month ago was if Jellyfin couldn’t access your media files for even a short period of time, it would delete all media from your playlists and you’d have to recreate them one one.
I don’t think that is how it works. I don’t necessarily need a reference to tell something is a good or a bad product. I have never said that Jellyfin is more polished than Plex is, just that my impreession is contadictionary to yours of Jellyfin being a duct-taped mess. No idea why you would argue against another persons obviously subjective opinion?
I’m not saying you don’t think it’s polished, I’m saying that if Jellyfin is where you set the bar for what “polished” means to you, then the rest of the open source world is going to blow your mind. Like you have nowhere to go but up from here.
Jellyfin being a duct taped mess on the other hand isn’t part of any subjective opinion, that’s just the state the software is in. Like it’s just missing basic features of its competitors, and has been stuck in relative development hell trying to rework the internals it inherited from Emby.
That’s subjective. I’ve never had an issue with it, neither has my wife or son or the couple of friends who use my media.
I wouldn’t call it subjective. The issues that it has are all objectively there, whether or not you’re bothered by them is what’s subjective. If you’re personally ok with all the quirks, bugs, missing features and general lack of polish that plague Jellyfin but not Plex more power to you. But those problems exist regardless, and they are the answer to the question you asked.
I didn’t know this was going to trigger so many people. lol. People paid money and are trying to justify their purchases. Good for everyone who uses it. I’ll continue using my “ugly, duct-taped-together mess” jellyfin I guess since I have zero issues with it and I don’t go out of my way to find “bugs” and “missing features” to just point out some things plex has that jellyfin lacks. Eh, it is what is.
You didn’t know that when you asked a question to the community that people would answer it? Ok.
So you asked the question rhetorically in bad faith because you just wanted to evangelize Jellyfin, got it. This is exactly why the Jellyfin’s Witnesses have the reputation they do lol
Of course it’s subjective, but it was you who asked why people continue to use Plex. This is a reason, and the reason is valid whether you share the same experience or not.
Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.
btw is passive agressive now?
How about quit reading tone into words and grow up a little.
Grow up a little, btw.
That’s the spirit!
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
EDIT:
Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031
Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.
And please run inside a non privliged container. Either use uidmap or go rootless.
I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.
Removed by mod
Removed by mod
Removed by mod
Removed by mod
Also I use Jellyfin btw.
Oh god, its the new Arch isn’t it…
No nix is the new arch.
Lol
I used to use Arch, now I use Nix, so that checks out
Except it makes sense to use
I’m waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
You will find them in their natural habitat, the crossfit/hyrox gym.
Apparently not using Arch is the only thing keeping me from reaching my peak in life
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
It’s been years, and there’s only now a handful of programs that offer some of Discord’s best features. If we had open source alternatives back then, I certainly would have entertained them.
Well exactly. The VC projects get to accelerate their “right now” factor with money. Money that doesn’t need to make a return on investment for another x years. That means, before those products start their hostile monetization campaigns, they will be unequivocally the best in their field by any metric other than “libre as in freedom”.
Look at Twitter. Did people that jumped ship jump to the relatively mature but “fiddly” federated platforms, or did they jump to “it’s literally Twitter but without ads and grok” in Bluesky?
We’re on Lemmy, so we’re obviously in a group more willing to tolerate “it’s an open protocol with some weirdness but that’s better than being on one corporation’s server beholden to their rules and TOS”.
Anyone switching from Plex to Emby in 2026 instead of to Jellyfin chose Emby for a reason. For them, Emby is a “better” product and “still free” the way Plex was free for all meaningful features (hardware acceleration, remote streaming…) in 2018. Maybe it’ll never happen, maybe it’ll take until 2030, who knows, but Emby is in the exact same state that Plex was before Plex closed the source and started rent-seeking.
I mean…I’m on both of those, but I know I can use Bluesky as a linear feed like Mastodon, and as long as that still works with no algorithm, it solves my Twitter problem. I think the cycle of software innovation is that you have the first proprietary tool that solves a problem, like MS Office or 3DSMax, and then the most important parts of those programs are solved in open source software after a lag, like LibreOffice or Blender. Discord would always be replaced in time.
But I haven’t paid anything to Emby (I don’t need the code behind that key) and without cloud, I could continue using this version forever and they can’t enshitify it
Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.
I just stream over SMB, much less fuckery tbh.
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that’s still possible though.
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
Nuvio is the same as Stremio except better, because it has more quality of life features (like a “Who’s watching” feature). I only mentioned Stremio because it’s more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it’s kinda like that.
Yeah I loved popcorn time. I’m looking into Stremio, and I’m already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn’t seem like anything I can recommend to nontechnical folks.
Well like I said, please look into Nuvio instead. I’m about to ditch Stremio and switch
I think it’s not a widely used phrase yet
It definitely is in this community
So what you’re saying is that you’re using it before it’s cool…
Idk, I think I heard peppe rice cream say it…
I have everything locally and watch on VLC fwiw /s
Now that is the arch of the self hosted streaming community.
If VLC is arch, what is MPV?
BSD
And MPC is Windows?
I can only vouch for old mpc and i think i remember it being clunky but decent. It’s been a very long time though
Nope
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
You mean watchtower by containrrr? That repo seems archived.
Also, if you don’t mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?
If it breaks I either fix it (often it’s just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can’t recover otherwise.
Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.
I use one of the maintained forks of watchtower.
I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don’t think I’ve experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I’m not sure if that’s safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.
Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?
Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there’s some config I’d have to do again and I don’t want to
I was also impacted, you need to remove the payload that got dumped:
Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid
Two processes named khungtaskd / cron
They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.
Then you can reclaim ownership and it resets the admin token.
You should likely be fine, I didn’t have any crypto miners on mine, it was just in a docker instance and didn’t have access outside of it. I would be much more worried if it was a direct install on a main PC.
Also install watch tower
Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.
I used the
nicholas-fedorWatchtower branch for a while.I use Dockhand now (switched to it when Portainer accounced their enshittification), and that has auto-update built-in. So I no longer needed Watchtower.
I believe Arcane also has auto-update, since Dockhand has hinted at their own enshittification a few years from now…
It was forked months ago and is actively developed https://github.com/nicholas-fedor/watchtower/
Yeah good call. I keep using an actively maintained fork because I can’t be bothered to switch to another project.
I checked tmp, and looked for suspicious processes or cron jobs, checked logs, I don’t see any reason to think I was impacted.
So that’s good.
How fuxked am I if my plex is running on unraid
I’m guessing this requires it be exposed to the Internet. Please stop exposing services to the Internet.
Sir, this is /c/selfhosted.
Kind of defeats the purpose of Plex and Jellyfin.
The only reason to expose it raw to the internet is because your hosting a piracy service.
You can easily keep everything inside of a wireguard VPN and expose nothing directly.
How do I get my grandparents tv on a vpn
You could put a Site2Site VPN on their router and your router. Bonus points if you use firewall rules to allow only your media server instead of your whole network.
*defeats your purpose of Plex and Jellyfin
I just want a media server. I have no use case to make it available to the public internet.
And who the fuck are you to speak for me? Some of us actually leave the basement.
That’s pretty much the number one reason people say they won’t move to Jellyfin - the ease of public access.
Even though exposing your shit to Internet is a terrible idea for most people.
I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.
And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.
Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.
Not if your Jellyfin is set up correctly.
Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
The start of this thread is “number one reason people don’t move to Jellyfin is ease of remote access.”
30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.
It’s literally just:
- create docker container
- forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
- forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS
I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.
Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90’s until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.
First it’s a VM because I’m not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there’s setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”
Beside, that wasn’t even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.
Port setup and it’s perceived impossibility by you has naught to do with that topic.
Just throw a wireguard tunnel on your router and call it a day.
If ya gotta host public put a dedicated proxmox host on its own port on your router, make it a trunk line, and give every VM its own subnet/VLAN/Firewall ruleset.
WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people
It’s really not. If people are too lazy to install one VPN app and import the tunnel config, then they can pay for paid streaming instead.
I manage it with netbird.
Just have em install netbird, if it’s on they can connect to my website. If it’s off they can’t.
It’s literally three steps for each person, there’s ways to make this easy. It just requires the host to put in the leg work
I’ll check it out! Thanks for the recommendation
Your welcome and good luck!
That’s fine for your personal remote access but that doesn’t help your 80 year old mother in law watch videos of the grandchildren on a Roku.
Been thinking of throwing together a set top box with everything made up for my grandfather so he can stream stuff from my jellyfin setup.
I just need to find an ezpz enough to use frontend.
Slap a vpn on her computer or but a shitty dell from good will. Point the Roku at that and forward the traffic…?
Like this is a solvable setup and forget about it for the next 5 years. Sort of set up.
