The update got released over 2 months ago. So sensible admins should not be getting hit by this.
Also I use Jellyfin btw.
Also I use Jellyfin btw.
Oh god, its the new Arch isn’t it…
I’m waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
You will find them in their natural habitat, the crossfit/hyrox gym.
I think it’s not a widely used phrase yet
It definitely is in this community
So what you’re saying is that you’re using it before it’s cool…
I have everything locally and watch on VLC fwiw /s
Everyone talks about Jellyfin, but I just switched to Emby and I couldn’t be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.
The main reason is that if you switch from Plex to Emby you’re going from paid licenseware (fully enshittified) to paid licenseware (not fully enshittified yet). It’s like when everyone finally dropped Skype and moved to… Discord. Which hey it’s closed source and owned by venture capital, but it doesn’t suck yet!!! And now in 2026, Discord is what Discord is.
It’s been years, and there’s only now a handful of programs that offer some of Discord’s best features. If we had open source alternatives back then, I certainly would have entertained them.
Well exactly. The VC projects get to accelerate their “right now” factor with money. Money that doesn’t need to make a return on investment for another x years. That means, before those products start their hostile monetization campaigns, they will be unequivocally the best in their field by any metric other than “libre as in freedom”.
Look at Twitter. Did people that jumped ship jump to the relatively mature but “fiddly” federated platforms, or did they jump to “it’s literally Twitter but without ads and grok” in Bluesky?
We’re on Lemmy, so we’re obviously in a group more willing to tolerate “it’s an open protocol with some weirdness but that’s better than being on one corporation’s server beholden to their rules and TOS”.
Anyone switching from Plex to Emby in 2026 instead of to Jellyfin chose Emby for a reason. For them, Emby is a “better” product and “still free” the way Plex was free for all meaningful features (hardware acceleration, remote streaming…) in 2018. Maybe it’ll never happen, maybe it’ll take until 2030, who knows, but Emby is in the exact same state that Plex was before Plex closed the source and started rent-seeking.
I mean…I’m on both of those, but I know I can use Bluesky as a linear feed like Mastodon, and as long as that still works with no algorithm, it solves my Twitter problem. I think the cycle of software innovation is that you have the first proprietary tool that solves a problem, like MS Office or 3DSMax, and then the most important parts of those programs are solved in open source software after a lag, like LibreOffice or Blender. Discord would always be replaced in time.
But I haven’t paid anything to Emby (I don’t need the code behind that key) and without cloud, I could continue using this version forever and they can’t enshitify it
Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that’s still possible though.
IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.
Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.
There are many reasons. Dont assume your use case is the only one.
I’m stoked on my Jellyfin setup, but I’ll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.
Nuvio is the same as Stremio except better, because it has more quality of life features (like a “Who’s watching” feature). I only mentioned Stremio because it’s more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it’s kinda like that.
Yeah I loved popcorn time. I’m looking into Stremio, and I’m already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn’t seem like anything I can recommend to nontechnical folks.
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
Hackers still doing cryptominers nowadays? C’mon, get with the times, install a LLM model on people’s computers instead.
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?
pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.
I got hit by this a couple days ago.
How did you detect and remove it
I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.
Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.
Did you reset your Plex admin keys?
Yeah, in the logs I saw they seemed to get my keys so I reset everything
What are admin keys that you’re referring to?
They’re cryptographic strings that plex uses to identify you on the back end. You reset them by changing your password and checking the sign out all devices button.
Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.
Some paid for lifetime and enjoy it. Or prefer the layout. Or prefer the easier sharing if data with family and friends.
There are still reasons to run Plex over Jellyfin for some, but not many of they keep going the way they are.
Understandable, but like I told the other person in another comment. Setting jellyfin on a friend’s device is as easy as setting up plex if you get a domain name. I have one from cloudflare that I pay $10 a month for. I create the user account on my end and only give my friend the server address and login
Sure, but I’ll use myself as an example: I don’t want any of my services exposed to the internet, so Tailscale/Netbird/other Wireguard solution is the best choice.
Some family members have their TV’s online with no Tailscale or media box, so that solution is out.Sure I could route all their Jellyfin traffic to my me via an exit node or VPN, but then we’re way deeper into this than my 60-something mother would ever want to. And I am on the hook for both her and my uptime. So phone/tablet/PC only if they don’t want a streaming device with native support.
The built in functionality on Plex is really practical, and practical is good for us creatures of comfort.
So I’m not disagreeing with you, just explaining what edge Plex still has over JF.
(And yes, I could do what you do and run with Cloudflare, but I don’t want to pay for it and I don’t want any traffic via third party I don’t trust)
It just werks.
I have Plex and Jellyfin but if I want to watch on my PS5, Plex has an official media app on there that’s really convenient to use.
Because Jellyfin is an ugly, duct-taped-together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.
That’s subjective. I’ve never had an issue with it, neither has my wife or son or the couple of friends who use my media.
I wouldn’t call it subjective. The issues that it has are all objectively there, whether or not you’re bothered by them is what’s subjective. If you’re personally ok with all the quirks, bugs, and missing features that plague Jellyfin but not Plex more power to you. But those problems exist regardless, and that’s a big reason why lots of people prefer Plex.
I didn’t know this was going to trigger so many people. lol. People paid money and are trying to justify their purchases. Good for everyone who uses it. I’ll continue using my “ugly, duct-taped-together mess” jellyfin I guess since I have zero issues with it and I don’t go out of my way to find “bugs” and “missing features” to just point out some things plex has that jellyfin lacks. Eh, it is what is.
You didn’t know that when you asked a question to the community that people would answer it? Ok.
So you asked the question rhetorically in bad faith because you just wanted to evangelize Jellyfin, got it. This is exactly why the Jellyfin’s Witnesses have the reputation they do lol
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
EDIT:
Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031
Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.
And please run inside a non privliged container. Either use uidmap or go rootless.
I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
Also I use Jellyfin btw.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
behold! the jellyfin community in a nutshell.
Removed by mod
