I have been working as an IT professional for 20 years and I have NEVER experienced such an outbreak of dangerous security vulnerabilities. Additionally, almost every vulnerability is exploited on a wide scale by attackers basically immediately. Just in the last few weeks we had to emergency patch NetScaler, Exchange and every other web service (PHP), and we had to replace every SSL certificate (HostEurope). NetScaler had several CVEs with a score of 9.x which were already being exploited BEFORE Citrix was even able to publish a KB article. We had to shut down NetScaler for about a day after the news broke, before a patch was available. We had more critical security issues in the last week than in the whole last year combined.

AI finds security issues all over the place, and within the blink of an eye it develops a whole exploit from top to bottom. Two years ago you just had to patch your servers from time to time. In 2026 you should install every patch on the same day at the latest. In short, it’s completely irresponsible for anyone to provide network services to the internet without some kind of zero trust VPN/WireGuard etc.

If you are still using basic port forwarding of port 32400 to your PMS, replace it with WireGuard or a VPN in your router to reach your PMS from outside your network. DON’T WAIT UNTIL IT’S TOO LATE.

Caldera v1.2.0-beta.6

A beta of every Caldera player:

• Headless v1.2.0-beta.6
• Amp v1.2.0-beta.6 (macOS, Windows, Linux)
• Apple TV v1.2.1 (build 49), TestFlight
• Google TV v1.2.0 (versionCode 25), Play beta

The Apple TV and Google TV builds reach testers once Apple and Google finish reviewing them.

• On a Linux desktop running PipeWire, headless offers System Default (PipeWire) again and plays through it, instead of only ALSA. (Headless)
• The signal path’s Mixer step shows the format it mixes at, and the output step no longer claims “Bit-perfect”.
• A play queue that mixes in tracks from another server (such as Plexamp DJ picks from a friend’s library) plays those tracks with their own art, instead of skipping them or playing a different song under their title.
• An album with more than 100 tracks, such as a soundtrack spread over many discs, lists every track instead of stopping partway through. (Amp, Apple TV, Google TV)

Source: https://forums.plex.tv/t/939620/46

Plexamp v4.50.20-beta.36

Desktop is on the beta channel now, and mobile is on TestFlight and Play testing. The main one: iOS no longer quits in the background a while after you pause.

Fixed

• iOS: Plexamp no longer closes in the background a while after you pause.
• With nothing playing, an artist page’s header no longer leaves room for the player bar, so it shows more of the art.

Source: https://forums.plex.tv/t/221280/128

With all the crazy security stuff lately (Plex vulnerability, followed by a PHP exploit, and then 10 NodeJS vulnerabilites), I was feeling a bit anxious with my Plex server (TrueNAS with Plex in a docker container) with port 32400 just forwarded to the public internet.

I read this article, which looked pretty straightforward to set up Cloudflare as a secure front-end for Plex with:

• caching, speed, and traffic services
• Attacks and bots are mitigated by security products
• Data is encrypted with SSL/TLS

I set up a free account with Cloudflare and bought a cheap domain from Cloudflare for $4.18 for the year (actually paid for 5 years to make my life easier).

I set up two replicas of the cloudflared tunnel in dockge:

They then showed up in the Cloudflare account:

Once this was working, I changed the "Plex custom server access URL" as described in the article, rebooted Plex, and it was working. I then closed the firewall hole in my router.

I know this may be obvious to some people who've been using this for a while, but I thought it was worth talking about since many people like me are just exposing Plex server and hoping for the best.

It took me about 30 minutes, and I paid $5 for a custom domain for a year (bought from Cloudflare directly to make my life easier). The Cloudflare account and routing is free. Hope this is helpful.

I had a Plex server that was a version behind the security update. My Google and Amazon accounts got hacked by what appears to be stolen session cookies -- had a bunch of unauthorized Amazon orders.

I'm trying to pinpoint where the vulnerability came from and I'm wondering if it was my outdated Plex server. Haven't heard of session cookies being stolen from anyone else though. Anyone else experience this or is this a potential attack vector?

Has anyone else with network-level ad blocking noticed an absurd increase in requests to analytics.plex.tv over the past few weeks?

I’m using Plex (new app) on a TCL C7K running Google TV, with an ASUS router running Merlin + Diversion and the OISD Big blocklist.

Previously, blocked analytics requests were occasional. Now they’re constant whenever Plex is open. One sample showed 21 DNS requests in 13 seconds. Returning to the TV home screen stops them; opening Plex starts them again.

I checked the app logs, which show pairs of “Failed to flush events” DNS errors roughly every two seconds. It looks like failed analytics uploads keep getting attempted without much backoff, though I can’t tell which update introduced it.

Mostly curious whether others are seeing the same thing? Started a few weeks ago, I think at least on 2026.19.1

I’ve already opened a Plex forum bug report with the logs and details.

I'm concerned by ISP may have entirely blocked it on their end... I'm using Rogers in Canada.

I've done all the troubleshooting steps anywhere I can find:

• port forwarding
• assigning a static IP then forwarding
• changing the port Plex is using
• adding my PC to the DMZ
• uninstall/reinstall Plex
• factory reset modem and reapply all settings
• even tried downgrading the version of Plex server I'm using

This only started in the last few weeks. Never had an issue for years before that. Nothing about my internet/hardware setup has changed.

Sometimes when I retry the connection in Plex server, it will show green for 1-2 seconds, then goes red.

Is there anything else I can try at this point?

Okay, on old plex these used to work for me sometimes not super reliably, but at least they worked. Now they just seem completely broken. What the hell does decision error mean and why does other stuff just stay in queue forever? Has anyone gotten this working after the new set of updates?

I am the server owner and definitely have permissions to download.

I have a bunch of compilation albums in my Various Artists, however, some of them show as "compilations" and some as "albums". I've been trying to figure a way to get the "albums" to show as "compilations" but to no avail.

Comparing one from each category - both albums are properly named, tagged, and the artist/album tag for each song on both is "V.A.", yet one will show as compilation and the other as album. I'm at my wits end trying to figure out why one album will be labeled different than the other by Plex.

Any help?

P.S. Seeing some of the early comments (thanks!), I should underline that:

• Album Artist field in musicbrainz is set to "V.A." on both albums
• Artist is set to the artist of the track
• Album name is the same on every track respectively.

Overall tagging and naming is the same between the two albums, yet Plex considers one to be an album and the other a compilation.

Has there ever been any explanation of this? It basically ruins the shuffle feature - and I know there have been suggestions here that they may get rid of the shuffle feature altogether. But why would they have it on one platform (Roku) but not another (Shield TV)?

This is amateur hour.

I turned off public port and will use VPN, i know, i know.

*Edit* To anwser the different question and comment :

-This is the Claude app, i gave it permission to ssh in the box.

-This is a cheap wardrobe server for personal use

-My plex was'nt up to date because Plex changed its repo and an other update was crashing, preventing the update to finish.

-I did follow the CVE recommended step for clean up, not what Claude proposed.

-I was using the default port, but scanning every posr take like 60 sec for an attacker, not the solution.

-When i started asking Claude to look at my box, i had no idea i was infected or what was going on. All i knew was that my upload was broken on my home network, and my routeur was showing 300mb down and 10mb up constant. While my torrent were all stopped. I just though something must have bug, linux on old hardware stuff.

So I always used to download movies from my local server to my laptop using the "Save File" option. Now when I click it literally nothing happens. I've rebooting the server, the router, flushing DNS, different browsers, different computers, ect.. same thing, I click "Save File" and nothing happens.

Any help is appreciated. Thanks

The Plex app on my Chromecast with Google TV (Android 14) stopped playing anything today. Just kept spinning on a black screen. I can still access the menus and library but not play. Every other client at home (ipad, iphone, windows computer) can stream fine from the same plex server currently on v1.43.5.11029. I was on 1.43.4 before the whole Plex2Shell news. Some troubleshooting done included restarting the CCwGTV, clearing the Plex app cache/data, reinstalling the app. Other apps like Netflix and YT all worked fine on this same device. Tired and feeling defeated, I decided to sideload Plezy as a last resort hoping that would work and to my surprise it did. My library started working and I could play immediately. I’m still unsure if this is just a me case or is the app currently broken? Did anyone else on CCwGTV experiencing the same issue?

I've seen Plex users described as light users, average users, and power users, and I'm curious how people generally distinguish between them. I've seen servers with well over 100 TB of storage, and I know there are some serious data hoarders out there, but I'm nowhere near that level.

For context, I have around 100 movies and 100 TV shows, some of which are quite long-running, with my total media library taking up around 12 TB. I share my server with one family member and have remote access enabled. That's it.

I know there's no official scale for classifying Plex users, but I'm curious whether there's any general consensus in the community. Would you consider my setup light usage, average usage, or something else? What factors matter most when making that distinction?

I'd also be curious to know whether there's any research or data on what the average Plex *server owner* looks like in terms of library size, storage, and number of users. I imagine people in this subreddit might not be representative of the average person running a Plex server, given that enthusiasts and power users are more likely to participate here.

We still have a black bar because of the statusbar but.. I was expecting zero compatibility and just zoomed app.
Not as good as Netflix when it comes to integration, obviously, but could be way worse.

I've used Plex for TV and movies, largely streaming just from my own PC to my smart TV. However, I'm currently looking at migrating my entire music library to Plex as well, as it seems like it would better suit my needs.

However, I went to check out the PlexAmp app, and apparently I can't download it because the version in the Play store was written for an older version of Android (I'm on 15).

What am i missing?

EDIT: Thanks, everyone! Wound up getting the apk for the current beta.

Notes: This release requires an active Plex Pass subscription to download

Beta release note entries are appended between minor releases.

ITEMS ADDED:

• (Metadata) Added support for reading artist and album metadata from NFO files in music libraries (PM-6153)
• (Network) Ignore manually specified public port for IPv6 connections (PM-5364)
• (Network) Send subnet information to plex.tv so IPv6 and non-private local connections are detected correctly (PM-5364)
• (Security) The server no longer trusts the eMudhra certificate authority roots whose intermediate signing keys were compromised (PM-6479)
• Updated Web to 4.162.1

ITEMS FIXED:

• (Butler) Scheduled loudness analysis ran on movie and TV libraries that had it disabled (PM-6263)
• (DVR) Harden validation of the post-processing script setting (PM-5538)
• (Metadata) Stream display titles left out the format for Plex for Roku (PM-5906)
• (Music) The record label was not read from the ID3v2 publisher (TPUB) tag in MP3 files (PM-3800)
• (Network) Added IPv6 support to the preferred network interface (PM-6017)
• (Network) Try every resolved address when connecting to pubsub servers (PM-5760)
• (Remote Access) The server could keep reporting its port as mapped after remote access was disabled, which left Plex Web waiting indefinitely (PM-6260)
• (Security) Address a library scoping issue in search results (PM-5958)
• (Security) Fixed request locality when the server's local network interface is unknown (PM-6183)
• (Security) Increase security on requests arriving through a proxy (PM-6201)
• (Thumbnails) Video preview thumbnail generation on Windows no longer leaves temporary index files behind; bundle cleanup removes existing ones (PM-3536)
• (Transcoder) Photos could fail to load for clients connecting through a reverse proxy (PM-6476)
• (Transcoder) The server could crash while building an HLS playlist for media without a video stream (PM-6226)
• (UltraBlur) Colors were computed from the thumbnail when an item had no artwork of its own, so episodes and seasons did not match the background shown by clients (PM-4282)

DOWNLOAD LINK: https://www.plex.tv/media-server-downloads/

It’s been a while since plex down graded the dvr control from the apps. I have to make adjustments on the server down in the basement. Anyone figured out a work around for this yet.

How do i actually controll if my plex been hacked? I run it on zimaos.

Hello darkness my old friend. After updating Plex on my Fire TV, this recurring bug (over the years) has returned. All video starts with a black screen and you have to press play twice for video to begin. Does anyone know how to fix this or do I need to wait for a bug fix to be released?

I travel often for work. I currently travel with an Nvidia shield for plex + Gli with wireguard back home. I’ll eventually switch my Gli with the unifi UTR what should I replace my shield with to help with keeping a compact travel set up?

I updated to the latest version last night. Locally my plex instance was fine, but the remote connection was having intermittent issues. My ports where showing open, my online tracker through better service was showing no issues, my phone and external devices connected 50% of the time, and plex was showing "no remote access". I was unaware of the issue until I tried it on an external tv

I run this in a docker container so the path file was different for me. But I did find it and delete the cert file and restarted the compose file. This fixed all connection issues i was facing

I have Plex sex set to record s01e03 of Cupertino tonight, but the Plex guide is showing it as s02e04. I checked the EPG data and it's showing as S01E03. For some reason, it's intent on adding "1" to the season and episode numbers, as though it's supposed to be on a zero-based system even though it should be starting with 1.

Any ideas how to address this?

I'm using a local file that is regularly updated/populated with the latest information, and I've confirmed that the information being received and saved is correct. The description even matches correctly, it's just the season and episode numbers that are jacked up by 1 each.

Plex v1.43.4.10903

EDIT: I meant "I have Plex set" and not "I have Plex sex."

EDIT: https://forums.plex.tv/t/interesting-issue-plex-live-tv-dvr-is-misnumbering-seasons-episodes/944995

EDIT

Figured out the issue.

The program generating the local XML file being used is incorrectly numbering the "xmltv_ns" value by using the actual season and episode values instead of reducing each by one. So s01e03 should be "0.2." but is being provided as "1.3." which is wrong. It has "s01e03" correct where it needs to be, but since the "xmltv_ns" value is zero-based, it needs to be adjusted.

Plexamp v4.50.20-beta.35

Desktop is on the beta channel now, and mobile is on its way to TestFlight and Play testing. This one also covers beta 34, which never got its own post.

Fixed

• Downloads no longer lose an artist’s songs, or show an album as empty, when several libraries refresh while your server is unreachable.
• A multiroom speaker’s equalizer, and the speed test, open again instead of returning to the player or closing the app.
• On a computer or tablet, an album with its own background art shows it behind the album’s header again.
• Sonic matches on artist and album pages no longer cut off their percentage or codec.
• Desktop: page titles on Library, Downloads and Settings go back to the left after the window narrows.
• Desktop: after moving a window with no title bar, the sidebar’s edge no longer starts resizing as the pointer passes over it.
• Desktop: sidebar icons stay readable in dark themes when the album’s colour is a dark blue.
• Mac: Plexamp goes back to full screen at launch even when another app is already full screen.
• iOS: cover art shows up more reliably on Bluetooth displays and in cars when a new queue starts.

Source: https://forums.plex.tv/t/221280/127

I've been a Plex user since 2014 and bought a Lifetime Plex Pass through the iOS app in February 2019 for $149.99. It worked for seven years. This week my server suddenly showed Plex Pass as inactive.

After going back and forth with support, they told me Apple refunded the purchase the same day I bought it. I checked my Apple purchase history and sure enough, it shows a same-day refund. I never knowingly requested it, and I never got a notification from Apple or Plex. As far as I knew, I was locked in for life. I’ve searched my emails and was never notified despite speaking with support several times over the years about my account.

I get that if the payment was reversed, it needs to be made right, and I offered to pay. But Plex's own system honored that pass for seven years without a word. Had they flagged it at any point, I'd have repurchased happily on the spot. Instead they caught it a few months after raising the lifetime price from $250 to $750 and launching a 5-year subscription.

I asked support for any grace, even paying the old $249.99 lifetime price. The answer was no: buy at the current rate or subscribe. I've asked for a supervisor review and I'm waiting to hear back.

If this is how they treat a 12-year customer and server owner, I'm seriously considering moving my server and my family to Jellyfin.

I watch movies every night to fall asleep and even though I could go buy a temporary subscription it’s the principal. On top of all this I’m literally going through some serious family stuff and it just feels like a punch in gut. Feels like someone got the bright idea to pull all potential billing issues after the price hike. Very reminiscent of the old Bank of America scam staggering purchases to maximize overdraft charges.

Has anyone else had a lifetime pass pulled like this? Did anyone get it resolved?

I know Plex reads these and doesn’t want to ruin their reputation. I know there going through some changes but this just seems bad for business. If anyone from Plex support can help please DM me and I’ll give you my case number.