QNAP warns of hacked NAS boxes via Plex: updating will not clean them

QNAP warns of hacked NAS boxes via Plex: updating will not clean them

6 November 2026: QNAP says users have reported Plex Media Server compromises on their NAS devices through the Plex2Shell attack chain, and that updating to 1.43.3.10861 will not remove anything already planted. Any server that was reachable from the internet on 1.43.2 or earlier needs a clean reinstall and new credentials.

Not yet independently verified. We read QNAP's notice but not Plex's own forum notice, which QNAP cites. The date of the public proof of concept comes through QNAP, and the US federal listing through BleepingComputer. We will update this when it can be confirmed, and remove this note.

How four limited flaws became one attack

Plex2Shell is the name for four vulnerabilities in Plex Media Server 1.43.2 and earlier: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. QNAP calls each one limited on its own, but chained together they let an unauthenticated remote attacker run code with the privileges of the Plex process.

According to Plex, as relayed by QNAP, a public proof of concept appeared on 16 October and widespread attacks on unpatched internet-facing servers followed, with compromised machines used for cryptocurrency miners and proxy software. BleepingComputer reports that researcher Zach Main told Plex about the flaws on 27 July, and that CISA added all four to its exploited list on 20 October.

QTS and QuTS hero, QNAP's operating systems, are not affected. The flaws are in the Plex application only, though on a NAS that application sits next to whatever else the box holds.

Checking whether a server was exposed

QNAP's test is whether Plex could be reached from outside on the vulnerable version. That means Remote Access turned on, port 32400 forwarded on the router, or UPnP opening it automatically. UPnP is the case that catches people out, because nobody chose to open the port.

Anyone in that position should do more than update:

• Preserve the Plex Logs folder first if QNAP support is to confirm a compromise
• Follow QNAP's FAQ for a clean reinstall of Plex
• Check the published indicators of compromise
• Reset Plex and NAS credentials

The update itself is in App Center, under My Apps, and the version can be confirmed in Plex Web under Settings, General.

Why this reaches beyond home media libraries

Plex is a consumer product, but a small office can end up running it on the same NAS that stores shared files and backups, and a proxy implant turns that box into a way into or through the network. A company with a NAS bought by a department rather than by IT may not have it on any asset list. The practical step is to scan the outside address range for port 32400 and ask around.

After the reinstall, QNAP advises turning off Remote Access and not forwarding 32400 unless it is needed, with a VPN used instead when it is. Other NAS makers that offer Plex packages have the same exposure wherever those packages were left on old versions. Our backup software category lists four products for teams who find their copies on that box were the only ones.

Company profile on TrustList: QNAP

Related on TrustList:

• Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3

Sources

• QNAP: Security notice on Plex Media Server vulnerabilities (Plex2Shell), 6 November 2026, 6 November 2026
• BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks, 6 November 2026, 6 November 2026