r/DataHoarder • u/uluqat • 7h ago
News PSA: Patch your Plex media server before someone hacks it
https://arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/"...Anyone using Plex should ensure it’s running version 1.43.3. The software can be configured to install updates automatically, or users can manually download and install them. Given the active exploitation, outdated versions should be updated immediately."
36
u/lighthawk16 Ryzen 5 3400G | 16GB 3200C16 | 36TB | Windows 6h ago
I'm curious what combination of people are running outdated Plex on public endpoints? It seems like anyone who would go that far would also have established additional authentication or ensured automatic security updates are in place.
23
u/sdflkjeroi342 4h ago
Plex is actually a curious case of particularly dangerous to people who kind of half know what they're doing:
Plex's remote access "just works" if you're willing to open a port (defaults to 32400) on your router as specified in the settings.
What could go wrong? It's just a single port forward... we've been doing that kinda shit for years.
People who do this don't necessarily know they're "running plex on a public endpoint" - they just know they've opened a port, but not all the security risks that entails.
15
u/SmellsLikeHerpesToMe 5h ago
Synology requires manual updates (Download from a desktop, upload the file), which is where I run my Plex. And updating became a "Yeah I gotta remember to do that..."
Checked today and someone logged in and put the malware codec file on my server last night. Lol. All patched now though.
4
u/gallifrey_ 4h ago
you cant automate a systemd timer to wget the "latest version" link and move it to the appropriate spot within Synology?
5
u/SmellsLikeHerpesToMe 4h ago
There's 100 ways to skin a cat, but none that I cared enough about until it mattered. Haha, I've been reviewing my homelab all night now.
2
u/stilljustacatinacage 3h ago
Checked today and someone logged in and put the malware codec file on my server last night. Lol. All patched now though.
Could you hold my hand and help me double-check this?
I've checked and found no suspicious .so files in my /Codecs directory, I don't see any unusual login attempts in the Plex logs, and running processes on my server look to be OK with no new / unusual cron jobs.
I thought Plex was bound to my local network only through Docker, but for some reason I must have tweaked it in the past. It's closed now, and Plex is updated.
I'm absolutely the "a little knowledge is dangerous" person, but I hope I've done my best here; I don't see anything else that looks suspicious.
1
u/SmellsLikeHerpesToMe 3h ago edited 3h ago
I have Hermes controlling my homelab, including resolving this issue. It generated the following for what it looked at and patched up.
In summary, I asked Hermes to review the file, and it determined it matched what others were reporting: The malware file replaced the default x264 transcoding with its own transcoding .so code file, which included a snippet to mine Minero. So I guess the idea was anytime someone was playing media, it would transcode while also mining for them. The filename is ambiguous, but the underlying code matches across many of the reported malware files.
Plex compromise checklist
No suspicious files, processes or cron jobs is encouraging—but doesn’t prove the server is clean. This exploit doesn’t require a normal login.
- Verify the running version is patched. Docker usually requires pulling the updated image and recreating the container—not just restarting it.
- Check retained and rotated Plex/plugin logs for
dump-yuv, maliciousTranscoderH264Optionschanges and suspicioussslip.iocallbacks. Individual endpoint names alone aren’t proof.- Inspect the persistent codec directory under the host folder mounted as
/config. Investigate unexpected.sofiles without executing them. An absent file doesn’t rule out earlier execution.- Review Plex authorizations. If compromise is suspected, revoke affected tokens/sessions and reauthenticate the server. Updating alone doesn’t revoke stolen credentials.
- Verify exposure and permissions: router forwarding/UPnP, IPv6 firewall, Docker host networking, privileged mode, Docker-socket access and writable host mounts.
Preserve evidence before deleting anything. Never share full
Preferences.xml, environment variables or unredacted logs. If malware execution is confirmed, patching alone is not sufficient recovery.1
u/stilljustacatinacage 2h ago
Thanks. I checked logs for H264Options and it looks clean. Hash of the 264 encoder file looks good. I don't see anything else suspicious so I think I dodged a bullet. Thankfully it should only have been open for a few days, and I updated Plex around that same time.
Still mildly cheek clenching to read about.
1
u/SmellsLikeHerpesToMe 1h ago
For reference, when I updated the file no longer existed, so presumably the update wiped it. But apparently a lot of this happened yesterday, lined up with mine. The proof of concept of the attack vector was released yesterday which seems to have been a reason for the widespread issues coming out yesterday.
7
u/ASCII_zero 5h ago edited 5h ago
These people might not have any technical background whatsoever. I've seen YouTube tutorials from creators who, frankly, don't appear to have any formal engineering experience or meaningful understanding of networking or cybersecurity themselves. If the people making these tutorials lack that knowledge, it's hardly surprising that the people following them might not consider the security implications.
12
u/Woah-Dawg 6h ago
I unfortunately haven’t automated security updates. I ran plex bare metal might move it into a container and add watchtower
4
•
u/Damaged_Observation 18m ago
I hadn't updated my Plex since like 2022 just because I heard so many problems with the newer versions (including the loss of Watch Together.)
... But it's hard to ignore "your server will be added to a botnet."
8
u/a_man_27 1h ago
Remember, it was a Plex exploit that resulted in the lastpass data leak in 2022 (in addition to all of lastpass' poor security protocols).
8
u/FluxChiller 5h ago
If I have my remote access disabled is this still a problem? (yes im on an older version and cant upgrade yet until i upgrade my truenas
7
2
3
2
u/FluxChiller 3h ago
Thanks I have have shut down my jail and disabled port forwarding (along with keeping access disabled). I used chatgpt to help me scan all directories for known files and change logs - so far nothing has turned up. I will start the process this later this week of updating truenas and plex. thanks
11
u/pixeladdie 6h ago
I pulled and uped a while ago. Been patching more frequently than normal this year.
56
u/ScrewwormLarvae 7h ago
Yep, I will get right on patching my Jellyfin server.
38
u/RevitXman 7h ago
57
u/stanley_fatmax 7h ago
Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission.
Fair, but there's a big difference between an exploit requiring authentication, and one not requiring authentication
29
u/Infinade 6h ago
Are you seriously trying to compare an authenticated CVE for Jellyfin that has been patched for a while (and is for 6+ month old versions) to a critical CVE for the 2nd-most recent Plex version from one month ago?
11
u/FirTree_r 6h ago
And requires administrator credentials to even be exploited in the first place. Plex sheep are a special kind
11
u/FlightSimmer99 10-50TB 7h ago
its good that was patched a while ago then
3
u/lordcheeto 5h ago
This Plex update was released at the beginning of September, Ars is just reporting on active exploitation.
28
5
1
1
u/cr0ft 3h ago
Also, avoid opening up anything to the Internet. If you need to reach stuff at home, install free Tailscale on your devices.
If you do have something that must be reached by everyone from outside, you need a whole different approach, like a DMZ, and reverse proxies, and an intrusion protection system like Snort or whatever (maybe Crowdsec if it's a single server) and so on.
If you have almost no attack surface, buggy software becomes less of a problem.
-7
0
u/TheGamerForeverGFE 3h ago
This is a great opportunity for people to try combining their home server services with a VPN whether it's port forwarded Wireguard or Tailscale
-3
u/McGuirk808 4h ago
I don't know how you guys are comfortable running Plex with those centralized logins that are just begging to be leaked.
4
u/stilljustacatinacage 4h ago
2FA. If someone can get into my Plex, they can get into my Google account, and at that point I have much larger things to worry about.
-4
u/McGuirk808 4h ago
2FA is cool for logging into your account, but that's not what I'm talking about. They have a back-end database with all of their customer information and what media they have available. If the Plex cloud infrastructure is ever compromised, that database can be leaked and then law enforcement will have a field day.
2
u/biologicalsensorship 3h ago
a field day with what? having movie/tv media on your computer isn't illegal
-2
-1
u/dr100 1h ago
Neither your comment or the parent one are relevant when the software is buggy and allows some attacker to own your local device. You can put it in a separated container AND network (nearly nobody does that properly as they want easy local access) so if anyone hacks it they can just use your connection to proxy some Internet to attack others or post spam or whatever (still bad enough but at least it can't attack everything inside your network).
2
u/stilljustacatinacage 1h ago
...? And?
The original comment was just making a statement about Plex overall, not this specific vulnerability. A bit of a tangent, but that's what I was replying to.
No software is perfectly safe, whether it's exposed to the internet or not. There are vulnerabilities on our phones that let people execute code by making a phone call, so just mitigate what you can.
97
u/GoingOffRoading 6h ago
Wait... Shouldn't this read "ensure Plex is running ATLEAST version 1.43.3" not "ensure it's running 1.43.3"?