356
Plex vulnerabilities being exploited in the wild to drop a cryptominer
(www.boredhackerblog.info)
this post was submitted on 19 Oct 2026
356 points (98.4% liked)
Selfhosted
63151 readers
1418 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Oh god, its the new Arch isn't it...
No nix is the new arch.
Lol
I used to use Arch, now I use Nix, so that checks out
Except it makes sense to use
I'm waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
Apparently not using Arch is the only thing keeping me from reaching my peak in life
You will find them in their natural habitat, the crossfit/hyrox gym.
Everyone talks about Jellyfin, but I just switched to Emby and I couldn't be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you're going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It's like when everyone finally dropped Skype and moved to... Discord. Which hey it's closed source and owned by venture capital, but it doesn't suck yet!!! And now in 2026, Discord is what Discord is.
It's been years, and there's only now a handful of programs that offer some of Discord's best features. If we had open source alternatives back then, I certainly would have entertained them.
Well exactly. The VC projects get to accelerate their "right now" factor with money. Money that doesn't need to make a return on investment for another x years. That means, before those products start their hostile monetization campaigns, they will be unequivocally the best in their field by any metric other than "libre as in freedom".
Look at Twitter. Did people that jumped ship jump to the relatively mature but "fiddly" federated platforms, or did they jump to "it's literally Twitter but without ads and grok" in Bluesky?
We're on Lemmy, so we're obviously in a group more willing to tolerate "it's an open protocol with some weirdness but that's better than being on one corporation's server beholden to their rules and TOS".
Anyone switching from Plex to Emby in 2026 instead of to Jellyfin chose Emby for a reason. For them, Emby is a "better" product and "still free" the way Plex was free for all meaningful features (hardware acceleration, remote streaming...) in 2018. Maybe it'll never happen, maybe it'll take until 2030, who knows, but Emby is in the exact same state that Plex was before Plex closed the source and started rent-seeking.
I mean...I'm on both of those, but I know I can use Bluesky as a linear feed like Mastodon, and as long as that still works with no algorithm, it solves my Twitter problem. I think the cycle of software innovation is that you have the first proprietary tool that solves a problem, like MS Office or 3DSMax, and then the most important parts of those programs are solved in open source software after a lag, like LibreOffice or Blender. Discord would always be replaced in time.
But I haven't paid anything to Emby (I don't need the code behind that key) and without cloud, I could continue using this version forever and they can't enshitify it
Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.
I just stream over SMB, much less fuckery tbh.
Jellyfin is based on the Emby-codebase before they relicensed it as closed source.
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that's still possible though.
I think it's not a widely used phrase yet
It definitely is in this community
So what you're saying is that you're using it before it's cool...
Idk, I think I heard peppe rice cream say it…
I have everything locally and watch on VLC fwiw /s
Now that is the arch of the self hosted streaming community.
If VLC is arch, what is MPV?
BSD
And MPC is Windows?
I can only vouch for old mpc and i think i remember it being clunky but decent. It's been a very long time though
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.
Ah yes, the better option is to... use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.
my jellyfin server continues to work if my internet is down. the choice is simple.
You're misrepresenting how it works. There is nothing "random" or "opaque" about Nuvio. You pick and choose the exact file you want to see, just like browsing torrents. I go with the REMUX every time.
And It's better because you can watch anything you want instantly without having to download it first then transfer it to your Jellyfin library, and then delete the file when you're done watching. Nuvio simplifies the entire process. (Of course you can also save your download to your library to watch again).
You people frustrate me so much; you rather make up lies than simply try the app and see for yourself how much better it is than Jellyfin. Nuvio can do everything Jellyfin does, except better.
I looked at it earlier... and it seemed ot be just another media app. Decided to take a closer look since you're so gung ho about it, and came to the same conclusion based on their website. Given what you're saying about it, and the complete lack of any of those claims by the company... you're the one not including relevant information.
The Nuvio website doesn't mention bittorrent usage at all. In fact, it doesn't mention acquiring media in any way. All of the advertising says the exact same thing that Plex, Emby, and Jellyfin all say.
That's literally what all of these media apps do. They take your existing media and make it pretty anbd easily accessible across devices.
Hmm seems to be advertising the app as something that i playing YOUR existing media, going going out to get new media you don't have... except for that bit about addons. What you're describing doesn't seem to be native functionality of the app, but probably something provided by one of the add-ons they mention. Of which there is no apparent way to browse their addon library without installing the app, and I'm not going to do that just for a random discussion online with someone that is leaving out relevant information to try and make the claim something is better, when the app claims to do the exact same thing.
In fact, the subreddit, also seems to indicate that content acquisition isn't in the scope of the app or community.
So you're entire basis for proselytizing this app over the several other existing ones the community has already verified and ensured quality of for years... is an unsupported addon that the app's own community denounces and could stop working at any point because it's not officially supported in any way
You can keep your year old app that already seems to have a dozen other vibe-coded forks using the same name without anyone enforcing any sort of trademark. I'm sure there's absolutely no astroturfing going on here at all for what seems to be a chinese clone. I'm sure the piracy community has gone through the entire source code with a fine-toothed comb to ensure there's nothing hiding in the main apps or the community addons and that all code review is d=properly verifying quality and security. /s
Out of the box, Nuvio cannot do much (hence why it's allowed in app stores).
Research more into now its plug-in system works. Specifically look into one of the following plug-ins: Torrentio or Comet.
Also learn what a Debrid service is, and then we can talk. Until then, knock it off with the conspiracy theories. It is mind-blowing to me how much effort you've put into wanting me to be wrong. That's fine; nobody's forcing you to use it. Stick with Jellyfin if it helps you sleep at night. I'll continue to enjoy pirating the easy way.
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
I'm stoked on my Jellyfin setup, but I'll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
Nuvio is the same as Stremio except better, because it has more quality of life features (like a "Who's watching" feature). I only mentioned Stremio because it's more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it's kinda like that.
Yeah I loved popcorn time. I'm looking into Stremio, and I'm already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn't seem like anything I can recommend to nontechnical folks.
Well like I said, please look into Nuvio instead. I'm about to ditch Stremio and switch
Nope