Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."
I too have an appreciation for crypto miners who don't try to hide the process. I inherited a PHP app that had been hacked and mined, and the wallet key was even an argument to the process it spawned :-)
I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?
There seems to be widespread disdain for it. AFAIK they switched to a shared codebase to make it easy for the devs to deploy to multiple devices. But, it came at the expense of UX for pretty much all devices. They don’t use native video services on things like iPhone.
I use Pleezy which has been a nice open source alternative to the Plex UI. The only issue we've had is that on wake, you have to press back once to do anything else. I'll eventually debug it and see if I can fix it.
On my iOS devices, hitting a season and then the episode always took me to the episode detail. I'm not sure if this is a setting to configure, I never changed any plex settings other than setting direct play.
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
The new UI version never made it to the Xbox client so that's what I switched to using about 6 months ago. As a bonus, I got to ditch my Roku altogether.
When Plex made their free TV channels front and center, I knew things would only get worse. I've been really happy with Jellyfin, especially with the Moonfin plugin. There is a weird issue with my Samsung TV never showing subtitles but that's my only complaint.
It doesn't cease to amaze me how uncreative attackers are time and time again. A cryptominer in 2026? They really earned the three cents they are getting out of that.
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.
Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.
I tried it once but had some issues where it was hard to get the Tailscale DNS to play nicely with my container setup. It's been a couple of years so I may be misremembering, but I want to say the issue was that it only would resolve names to the IP of the host, not the containers themselves. That could've changed by now, of course.
It's my love letter to owning multimedia.
I'm focused on minimizing friction; all comms go over Iroh, and it even works in the browser via webrtc (as of yesterday). No network expertise required.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
It's a remote media streaming tool as much as a local one.
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
Neat! So when you're on your tv stick or whatever, before deciding that you want to watch any movie in particular (so before the ephemeral jellyfin container is running), how does the movie selection process work?
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
You can opt-in automatic updates. If you install the non-container package, you can set it to auto upgrade.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.
Nope, at least not on the platform I'm on. Just get the popup when accessing media when there is an update and can automate it or schedule for evening, but no way to automatically update it.
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
Plex2Shell is the proof-of-concept exploit that is feeding this. An LLM chained together several CVEs: https://zmain.info/blog/plex2shell
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
Selecting a season and then the episode gives you the episode summary instead of just playing the episode.
Hitting back on an episode brings up a side menu sometimes and others it leaves the episode like it should.
Why Plex?
I don't have the "back" issue, there's an "X" on the iOS app to tap to exit the video, and the "menu" key on my Apple TV works as always.
So much for unifying the code bases! :D
https://amphetamem.es/meme?id=office-space_1999_1140&text=Bu...
This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.
The chief complaint is really an indictment of every piece of shit modern web app backend.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.
[email protected] if interested
I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?
Thanks!
Affects an older version of Plex and was patched in August.
I have a lifetime subscription, I use plex to share the media with the wife and kids on all of our devices, it does the job. I won't bitch about their streaming ambitions, but doing automatic updates and taking security seriously would go far for them.
With containers it's a questionable/clunky implementation but possible. It only works in one flavor of their official image. On startup it will check if there is an update and download it and replace the application in the container. It breaks the point of containers obviously. It also only runs on startup, so you need to restart the container to get it to run.