The update got released over 2 months ago. So sensible admins should not be getting hit by this.

Also I use Jellyfin btw.

top 80 comments

sorted by: hot top controversial new old
[–] 24 points 2 weeks ago (3 children)

As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low

  • source
  • hideshow 3 child comments
  • [–] 4 points 2 weeks ago (2 children)

    You mean watchtower by containrrr? That repo seems archived.

    Also, if you don't mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 weeks ago*

    If it breaks I either fix it (often it's just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can't recover otherwise.

    Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

  • source
  • parent
  • [–] 1 point 2 weeks ago

    I use one of the maintained forks of watchtower.

    I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don't think I've experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I'm not sure if that's safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.

  • source
  • parent
  • [–] 137 points 2 weeks ago (40 children)

    Also I use Jellyfin btw.

    Oh god, its the new Arch isn't it...

  • source
  • hideshow 40 child comments
  • [–] 5 points 2 weeks ago (5 children)

    I have everything locally and watch on VLC fwiw /s

  • source
  • parent
  • hideshow 5 child comments
  • [–] 10 points 2 weeks ago (4 children)

    Now that is the arch of the self hosted streaming community.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 2 weeks ago (3 children)
  • [–] [S] 5 points 2 weeks ago (3 children)

    I think it's not a widely used phrase yet

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 2 weeks ago (9 children)

    Everyone talks about Jellyfin, but I just switched to Emby and I couldn't be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 36 points 2 weeks ago (6 children)

    The main reason is that if you switch from Plex to Emby you're going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It's like when everyone finally dropped Skype and moved to... Discord. Which hey it's closed source and owned by venture capital, but it doesn't suck yet!!! And now in 2026, Discord is what Discord is.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 2 weeks ago (2 children)

    It's been years, and there's only now a handful of programs that offer some of Discord's best features. If we had open source alternatives back then, I certainly would have entertained them.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 weeks ago* (last edited 2 weeks ago) (1 child)

    Well exactly. The VC projects get to accelerate their "right now" factor with money. Money that doesn't need to make a return on investment for another x years. That means, before those products start their hostile monetization campaigns, they will be unequivocally the best in their field by any metric other than "libre as in freedom".

    Look at Twitter. Did people that jumped ship jump to the relatively mature but "fiddly" federated platforms, or did they jump to "it's literally Twitter but without ads and grok" in Bluesky?

    We're on Lemmy, so we're obviously in a group more willing to tolerate "it's an open protocol with some weirdness but that's better than being on one corporation's server beholden to their rules and TOS".

    Anyone switching from Plex to Emby in 2026 instead of to Jellyfin chose Emby for a reason. For them, Emby is a "better" product and "still free" the way Plex was free for all meaningful features (hardware acceleration, remote streaming...) in 2018. Maybe it'll never happen, maybe it'll take until 2030, who knows, but Emby is in the exact same state that Plex was before Plex closed the source and started rent-seeking.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 weeks ago

    I mean...I'm on both of those, but I know I can use Bluesky as a linear feed like Mastodon, and as long as that still works with no algorithm, it solves my Twitter problem. I think the cycle of software innovation is that you have the first proprietary tool that solves a problem, like MS Office or 3DSMax, and then the most important parts of those programs are solved in open source software after a lag, like LibreOffice or Blender. Discord would always be replaced in time.

  • source
  • parent
  • [–] -1 points 2 weeks ago (2 children)

    But I haven't paid anything to Emby (I don't need the code behind that key) and without cloud, I could continue using this version forever and they can't enshitify it

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 2 weeks ago

    Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that's still possible though.

  • source
  • parent
  • [+] -7 points 2 weeks ago* (last edited 2 weeks ago) (13 children)

    IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 16 points 2 weeks ago (4 children)

    Ah yes, the better option is to... use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 0 points 2 weeks ago (2 children)

    You're misrepresenting how it works. There is nothing "random" or "opaque" about Nuvio. You pick and choose the exact file you want to see, just like browsing torrents. I go with the REMUX every time.

    And It's better because you can watch anything you want instantly without having to download it first then transfer it to your Jellyfin library, and then delete the file when you're done watching. Nuvio simplifies the entire process. (Of course you can also save your download to your library to watch again).

    You people frustrate me so much; you rather make up lies than simply try the app and see for yourself how much better it is than Jellyfin. Nuvio can do everything Jellyfin does, except better.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 weeks ago* (1 child)

    I looked at it earlier... and it seemed ot be just another media app. Decided to take a closer look since you're so gung ho about it, and came to the same conclusion based on their website. Given what you're saying about it, and the complete lack of any of those claims by the company... you're the one not including relevant information.

    The Nuvio website doesn't mention bittorrent usage at all. In fact, it doesn't mention acquiring media in any way. All of the advertising says the exact same thing that Plex, Emby, and Jellyfin all say.

    Nuvio does not come with a catalogue. It plays the media you already have, and adds everything around it: the artwork, the numbers, the subtitles, and the memory of where you stopped.

    That's literally what all of these media apps do. They take your existing media and make it pretty anbd easily accessible across devices.

    It plugs into what you already use.

    Nuvio plays from your own media server or from the addons you install. Tracking, ratings, artwork and skip markers come from the services you already use.

    Hmm seems to be advertising the app as something that i playing YOUR existing media, going going out to get new media you don't have... except for that bit about addons. What you're describing doesn't seem to be native functionality of the app, but probably something provided by one of the add-ons they mention. Of which there is no apparent way to browse their addon library without installing the app, and I'm not going to do that just for a random discussion online with someone that is leaving out relevant information to try and make the claim something is better, when the app claims to do the exact same thing.

    In fact, the subreddit, also seems to indicate that content acquisition isn't in the scope of the app or community.

    Nuvio welcomes community addons that provide metadata (TMDB, Trakt, Simkl), subtitles, and custom catalogs. However, discussions or addons that facilitate access to copyrighted content, stream scraping or debrid link troubleshooting are strictly prohibited on r/nuvio. Posts containing images of unauthorized streams or stream-scraping addons are subject to removal. Violations of these rules will be removed.

    So you're entire basis for proselytizing this app over the several other existing ones the community has already verified and ensured quality of for years... is an unsupported addon that the app's own community denounces and could stop working at any point because it's not officially supported in any way

    You can keep your year old app that already seems to have a dozen other vibe-coded forks using the same name without anyone enforcing any sort of trademark. I'm sure there's absolutely no astroturfing going on here at all for what seems to be a chinese clone. I'm sure the piracy community has gone through the entire source code with a fine-toothed comb to ensure there's nothing hiding in the main apps or the community addons and that all code review is d=properly verifying quality and security. /s

    GitHub Account Age Checker
    https://github.com/NuvioMedia
    Username: NuvioMedia
    Created at: Mar 12, 2026, 2:11:01 AM (China Standard Time)
    Account age: 223 days, 4 hours, 8 minutes

  • source
  • parent
  • hideshow 1 child comment
  • [–] -2 points 2 weeks ago*

    Out of the box, Nuvio cannot do much (hence why it's allowed in app stores).

    Research more into now its plug-in system works. Specifically look into one of the following plug-ins: Torrentio or Comet.

    Also learn what a Debrid service is, and then we can talk. Until then, knock it off with the conspiracy theories. It is mind-blowing to me how much effort you've put into wanting me to be wrong. That's fine; nobody's forcing you to use it. Stick with Jellyfin if it helps you sleep at night. I'll continue to enjoy pirating the easy way.

  • source
  • parent
  • [–] 3 points 2 weeks ago (3 children)

    I'm stoked on my Jellyfin setup, but I'll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 2 weeks ago* (2 children)

    Nuvio is the same as Stremio except better, because it has more quality of life features (like a "Who's watching" feature). I only mentioned Stremio because it's more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it's kinda like that.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 2 weeks ago (1 child)

    Yeah I loved popcorn time. I'm looking into Stremio, and I'm already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn't seem like anything I can recommend to nontechnical folks.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 weeks ago (2 children)

    @Psythik Never heard of it, what's the license?@ExcessShiv

  • source
  • parent
  • hideshow 2 child comments
  • [–] -2 points 2 weeks ago* (last edited 2 weeks ago) (1 child)

    What license? Like Jellyfin, It's for piracy. Basically every streaming service combined into one. It relies on torrents, cached torrents, and Usenet find you the fastest way to instantly steam anything you want.

  • source
  • parent
  • hideshow 1 child comment
  • [+] 1 point 2 weeks ago (1 child)
  • [–] 0 points 2 weeks ago

    That's not how this works. If you don't want a shit bitrate, don't pick a file with a shit bitrate to stream. I go for the REMUX every time. I have no issues streaming a 70GB file over my gigabit 5G home internet connection. If you have slow internet, then I can understand why you'd prefer Jellyfin.

  • source
  • parent
  • load more comments (-1 replies)
  • [–] 47 points 2 weeks ago (2 children)

    Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.

    A vulnerability? No…. 4 of them. And they stack.

  • source
  • hideshow 2 child comments
  • [–] 11 points 2 weeks ago (2 children)

    Hackers still doing cryptominers nowadays? C'mon, get with the times, install a LLM model on people's computers instead.

  • source
  • hideshow 2 child comments
  • [–] 6 points 2 weeks ago (2 children)

    My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.

    My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th... no doubt from dirtbags trying to exploit this.

  • source
  • hideshow 2 child comments
  • [–] 6 points 2 weeks ago* (last edited 2 weeks ago) (7 children)

    Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?

    Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there's some config I'd have to do again and I don't want to

  • source
  • hideshow 7 child comments
  • [–] 10 points 2 weeks ago (6 children)

    I was also impacted, you need to remove the payload that got dumped:

    Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid

    Two processes named khungtaskd / cron

    They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance.

    Then you can reclaim ownership and it resets the admin token.

    You should likely be fine, I didn't have any crypto miners on mine, it was just in a docker instance and didn't have access outside of it. I would be much more worried if it was a direct install on a main PC.

    Also install watch tower

  • source
  • parent
  • hideshow 6 child comments
  • [–] 9 points 2 weeks ago (3 children)

    Second post I’ve seen mentioning watchtower… it quit being developed about a year ago and is read-only now. I quit recommending it since it’s not being actively developed any longer.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 weeks ago

    I used the nicholas-fedor Watchtower branch for a while.

    I use Dockhand now (switched to it when Portainer accounced their enshittification), and that has auto-update built-in. So I no longer needed Watchtower.

    I believe Arcane also has auto-update, since Dockhand has hinted at their own enshittification a few years from now...

  • source
  • parent
  • [–] 14 points 2 weeks ago (1 child)

    If you want to expose plex to the open Internet (not a VPN) Don't open the plex port to the internet. Turn off the "remote access" setting and run it behind a reverse proxy instead.

  • source
  • hideshow 1 child comment
  • [–] 4 points 2 weeks ago* (last edited 2 weeks ago) (1 child)

    i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?

    pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.

  • source
  • hideshow 1 child comment
  • [–] 3 points 2 weeks ago (6 children)

    I got hit by this a couple days ago.

  • source
  • hideshow 6 child comments
  • [–] 6 points 2 weeks ago (5 children)

    How did you detect and remove it

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 2 weeks ago (4 children)

    I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.

    Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 2 weeks ago (3 children)

    Did you reset your Plex admin keys?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 2 weeks ago* (2 children)

    Yeah, in the logs I saw they seemed to get my keys so I reset everything

  • source
  • parent
  • hideshow 2 child comments
  • [–] [B] 5 points 2 weeks ago* (last edited 2 weeks ago)

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

    Fewer Letters More Letters
    CSAM Child Sexual Abuse Material
    DNS Domain Name Service/System
    ISP Internet Service Provider
    LXC Linux Containers
    Plex Brand of media server package
    SMB Server Message Block protocol for file and printer sharing; Windows-native
    UDP User Datagram Protocol, for real-time communications
    VNC Virtual Network Computing for remote desktop access
    VPN Virtual Private Network
    nginx Popular HTTP server

    10 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

    [Thread #141 for this comm, first seen 19th Oct 2026, 23:00] [FAQ] [Full list] [Contact] [Source code]

  • source
  • [–] 2 points 2 weeks ago*

    I got all worried and updated (I basically never do) and then went to put in my password to log back in and then go searching for payload files and whatever, and wouldn’t you know it I was smart as shit and made the password tell me in no uncertain terms that I changed it for exactly that problem! Could stop worrying!

    I did it because I was annoyed at having to do it I'm sure, but man it turns out that was a great idea!

  • source
  • [–] 3 points 2 weeks ago (2 children)

    Jellyfin has plenty of issues with public instances too. It's just the reality of exposing to the public internet, unless it's something that has a lot of dedicated work going into security it's going to have problems.

  • source
  • hideshow 2 child comments
  • [–] 4 points 2 weeks ago (1 child)

    Could you specify any of those issues? I ask because the only one I'm tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 2 weeks ago* (last edited 2 weeks ago)

    Also I use Jellyfin btw.

    You shouldn't be talking with the amount of hilarious CVEs jellyfin has also had lmao

    EDIT:

    Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031

    Your downvotes are meaningless, please don't run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.

    And please run inside a non privliged container. Either use uidmap or go rootless.

    I'm pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.

  • source
  • load more comments
    view more: next ›