Plex vulnerabilities being exploited in the wild to drop a cryptominer

Yeah, this happened to me the other day. I completely missed their "please upgrade now" email on Sep 1st and was running a 13 month old version. I got a notification that my home server was at 100% usage, and found the miner right away. At least they were nice enough to name the process "mylovelyminer."

I find plex unusable since the latest UI updates in any place but my PC browser. It's so slow that Jellyfin is really my only option now. Did the vibe-code the new changes or what?

> internet-facing Plex servers

This is terrifying. Who runs things like this open to the outside?

I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".

After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.

I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).

Reddit discussion here: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exp...

Affects an older version of Plex and was patched in August.

[flagged]