r/PleX • u/TinyZonesOfNature • 8h ago

Help Are the new PHP vulnerabilities different from the Plex2shell vulnerability?

I'm all clear on the Plex2shell issue, but wondering if I'm at risk from a separate PHP vulnerability. Should I be taking things offline? Thanks.

0 Upvotes

44% Upvoted

15 comments sorted by

14

u/Complex_Solutions_20 8h ago

They are not related as far as I'm aware. The Plex vulnerability was patched before the PHP one was announced or patches released.

I don't know if Plex uses PHP, but if you use PHP at least better be patching it ASAP today.

15

u/BagMostlyWater 8h ago

plex does not use PHP

1

u/TinyZonesOfNature 8h ago

Good to know, thank you.

Yeah, I check daily for updates and apply them immediately.

Think I'll take things down for now. Cheers

3

u/Holigrafik 8h ago

I just enabled the enhanced firewall features of my router about 24 hours ago after finding out about this plex issue. It has already logged 4 plex2shell attempts to my plex server in the last 24 hours. Has come from the USA, Netherlands, and Germany so far

1

u/frockinbrock 6h ago

Can I ask which router? Is it like a paid add-on for that Firewall?

2

u/Holigrafik 6h ago

UniFi dream machine pro. It has built in threat management but you can also pay $99 a year for enhanced and through cloudflare or something.

1

u/frockinbrock 2h ago

Okay thanks!

1

u/Agile-Cardiologist22 2h ago

Lmao people telling me that country blocking made a difference yesterday

6

u/derfmcdoogal 8h ago

Adding "2shell" to your vulnerability is the new hot thing.

4

u/Tucsondirect 5h ago

no, it's just the severity and there have been a rash of them..... Shell access is essentially same as physical access.... and is the worst kind of vulnerability you could have

1

u/akatherder 8h ago

Yes, the only similarity in php2shell and plex2shell is the ability to run "shell" commands. Basically run things from a command line/command prompt. The underlying security issues are different and php2shell doesn't impact plex.

Most of the common plex-related stuff is fine. None of these run on PHP: sonarr, radarr, prowlarr, qbittorrent, bazarr, gluetun, seerr, tautulli. Most of those aren't typically exposed to the internet anyway.

4

u/PCgaming4ever 90TB+ | OMV i5-12600k super 4U chassis 7h ago

You couldn't pay me to expose any of the ARR stuff to the web. Way way way too slow of updates absolutely full of security holes to do that so pretty easy to just wall them off and move on with my life

2

u/TinyZonesOfNature 8h ago

Thank you for breaking that down. Cheers

1

u/amiga1 6h ago

as long as you haven't done something mega stupid like exposing your firewall management page on WAN then you're fine. plex doesn't use php. opnsense uses php for the management page, maybe others are affected.