Plex2Shell QNAP NAS Attacks: Hackers Are Breaching NAS Devices Through Plex Media Server, and Why Updating to 1.43.3.10861 Is Not Enough
QNAP says attackers are compromising NAS devices through Plex2Shell, a chain of four exploited Plex Media Server flaws. Update to 1.43.3.10861, and if Plex was reachable from the internet, treat the NAS as compromised.
Where Worldwide
On this page 10 sections
QNAP says attackers are breaking into its NAS devices through Plex Media Server, using a chain of four exploited Plex flaws known as Plex2Shell. If your company runs Plex on a QNAP NAS and Plex could be reached from the internet before you updated to version 1.43.3.10861, QNAP says to treat that NAS as possibly compromised. Updating does not remove anything an attacker already installed.
That matters most where the same box holds company files, backups or the passwords for cloud backup jobs. Here is what the primary sources confirm, what they do not, and what to do this week.
What happened with Plex2Shell
The timeline below comes from the researcher's write-up, Plex, CISA and QNAP:
- July 27, 2026: A researcher who publishes under the handle "zmain" reported the flaws to Plex. Their write-up gives only the handle, not a full name.
- August 4, 2026: Plex acknowledged the report and paid a bug bounty.
- September 23, 2026: The four CVE numbers were assigned.
- October 16, 2026: The researcher published the technical write-up. Plex and QNAP both call this the release of a public proof of concept.
- October 19, 2026: Plex posted on its forum that the flaws are "actively and widely exploited" against internet-facing servers that have not been updated. Plex says hacked servers have been used to run cryptocurrency miners and proxy software.
- October 20, 2026: CISA added all four CVEs to its Known Exploited Vulnerabilities catalog.
- November 6, 2026: QNAP published a security notice and a check-and-remediation FAQ. QNAP says it has received user reports of Plex compromises on NAS devices and is helping the affected users.
What is confirmed and what is not
Confirmed by primary sources:
- Plex Media Server 1.43.2 and earlier is vulnerable. Plex says builds older than 1.43.3.10861 should be treated as vulnerable and that 1.43.3.10861 and later are not affected.
- Plex says that when the four flaws are chained, an attacker with no login can run code with the privileges of the Plex Media Server process.
- QNAP's security team says the flaws exist only in Plex Media Server. QTS, QuTS hero and other QNAP operating systems are not affected.
- The fixed Plex build is available in the QNAP App Center.
Not known:
- How many QNAP devices have been compromised. QNAP gives no count.
- Whether attackers stole files from any NAS. The confirmed activity is crypto mining and proxy software, but QNAP still tells owners to treat every shared folder Plex could reach as possibly exposed.
- Whether ransomware groups are using the chain. CISA lists known ransomware use as "Unknown" for all four CVEs.
The four Plex2Shell CVEs
Plex and CISA describe one of the four flaws differently, so the table shows both:
| CVE | What Plex says | What CISA's catalog says |
|---|---|---|
| CVE-2026-96652 | Server-side request forgery (SSRF) through the player timeline endpoint, no login needed | SSRF: any X-Plex-Token value lets an attacker put a full URL in the protocol parameter |
| CVE-2026-96654 | Access to internal agent functions through the loopback interface | Lets an attacker call other plugins' functions with their own parameters |
| CVE-2026-96655 | Exposure of the server owner's admin token | SSRF through the transcode path parameter, letting an authenticated user request internal or external addresses |
| CVE-2026-96656 | Arbitrary file write to the Codecs folder through transcoder preferences | Lets an admin user write arbitrary files that may be executed on load |
The gap is CVE-2026-96655. Plex calls it a leak of the owner's admin token. CISA calls it an SSRF bug that needs an authenticated user. Neither source explains why they differ, and the researcher's write-up does not say which bug maps to which CVE. The researcher does describe an owner-token leak caused by a loopback check that only matches the start of a URL, which fits Plex's wording. For patching it makes no difference: all four are fixed in 1.43.3.10861, and CISA says all four can be chained. The researcher rates the chain 9.8 out of 10 (Critical).
Is my QNAP NAS affected by Plex2Shell?
Your NAS is at risk if it runs Plex Media Server 1.43.2 or earlier. QNAP says to treat it as possibly compromised if any of these were true while it ran a vulnerable version, or if you only updated after October 16:
- Remote Access was turned on in Plex Web (Settings, Remote Access).
- Your router forwards port 32400 to the NAS.
- UPnP was on at the router and Plex Remote Access was on, so Plex opened the port by itself.
- Plex was exposed through myQNAPcloud auto router configuration or some other way.
How to check your Plex Media Server version on QNAP
- Open App Center, then My Apps.
- Find Plex Media Server and read the version. You need 1.43.3 (build 1.43.3.10861) or later.
- If no update shows, refresh App Center and make sure the NAS can reach the internet.
- After updating, confirm the version in Plex Web under Settings, General.
Signs your NAS was hacked through Plex
Plex and QNAP list the same warning signs:
- Unknown processes started by Plex Media Server, with names like myawesomeproxy, mylovelyminer or x12345.
- Unfamiliar .so or .dll files in the Plex Codecs folder.
- Outbound connections to proxystream.st.
- High CPU use that doesn't drop when nothing is playing (check Resource Monitor).
- A QNAP Malware Remover detection, such as code MR2104.
QNAP warns against deleting just the suspicious program, because other pieces may stay behind. Do the full clean reinstall below.
What to do this week
| Step | What to do |
|---|---|
| Update Plex | App Center, My Apps, Plex Media Server, Update. Confirm 1.43.3.10861 or later. |
| Decide if it was exposed | Check Plex Remote Access, port 32400 forwarding, UPnP and myQNAPcloud auto router settings. |
| Save evidence | Before removing Plex, copy the Logs folder from "Plex Media Server" in the PlexData shared folder if you want QNAP Support to investigate. |
| Clean reinstall (if exposed) | Remove Plex. Delete everything in the Codecs folder and check Preferences.xml for transcoder options nobody set. Reinstall 1.43.3 or later. Do not restore old Codecs files. |
| Reset Plex access | Sign out all devices in your Plex account first, then change the password. |
| Reset NAS access | Change admin and user passwords, turn on two-step verification, and rotate passwords or access keys for backup jobs and cloud connections on the NAS. |
| Close the door | Turn off Plex Remote Access if nobody needs it, remove the port 32400 forward, turn off UPnP and remove the myQNAPcloud auto router entry for Plex. |
| Remote access the safe way | If people need Plex remotely, use a VPN such as QNAP's QVPN Service. |
| Keep watching | Update QTS or QuTS hero and every app. Turn on scheduled Malware Remover scans and QuFirewall. |
Why Plex2Shell matters for a business network
Plex is often installed on business NAS units for training videos, lobby screens, marketing libraries or client media at agencies and studios. It usually gets added once and then forgotten. The trouble is what else lives on that NAS: shared drives, backup targets and saved passwords for cloud storage. QNAP's advice to rotate backup and cloud credentials, and to treat every shared folder Plex could reach as exposed, reflects that.
The confirmed payloads also cost you even if no file ever leaves the building. A crypto miner eats the processor your backups and file shares rely on. Proxy software sends strangers' internet traffic out through your business connection, so whatever they do appears to come from your IP address. That can get the address blocklisted and pull you into abuse complaints.
If your storage, media or backup servers are self-hosted, every app on them needs an owner who tracks its updates. Our self-hosting infrastructure page explains how we set up those systems so nobody has to open ports to the internet.
Plex2Shell questions people are asking
What is Plex2Shell?
Plex2Shell is the name for four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656). Plex says that chained together, they let an attacker with no login run code on the server.
Is QNAP QTS affected by Plex2Shell?
No. QNAP says QTS, QuTS hero and its other operating systems are not affected. The risk comes from the Plex Media Server app installed on the NAS.
What version of Plex fixes Plex2Shell?
Plex Media Server 1.43.3.10861 or later. On QNAP, it is in the App Center.
Does updating Plex remove the malware?
No. QNAP says updating does not remove anything an attacker installed. If Plex was exposed, do a clean reinstall and reset your Plex and NAS credentials.
Is Plex2Shell being exploited?
Yes. Plex says the flaws are actively and widely exploited, CISA added all four to its exploited list on October 20, 2026, and QNAP has user reports of compromised NAS devices.
Do I need to close port 32400?
If nobody needs to reach Plex from outside, yes. Plex and QNAP both say to turn off Remote Access and stop forwarding port 32400, and to use a VPN if remote access is needed.
Does Plex2Shell affect Synology or other NAS brands?
The flaws are in Plex Media Server itself. Plex says any build older than 1.43.3.10861 is vulnerable, whatever it runs on. QNAP's notice covers only QNAP devices.
The bigger lesson
The app that puts a NAS at risk is often not the storage software. It is a media server or add-on someone installed years ago and never thought about again. Plex fixed these flaws, but NAS owners who never checked their apps, or who left a port open "just for convenience," were exposed once the write-up went public. Make a list of every app on every server you own, name the person who updates each one, and don't let anything face the internet unless a business need justifies it.
See how we lock down servers and storage at security hardening, or get a quote to have your NAS and network reviewed.
Get security alerts like this by email, with our free checklist, at security alerts.
Sources: QNAP Security Notice: Plex Media Server Vulnerabilities (Plex2Shell); QNAP Plex2Shell Check and Remediation FAQ; Plex: Important Security Update for Plex Media Server; CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog; CISA Known Exploited Vulnerabilities Catalog; zmain: Plex2Shell write-up.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
Ransomware Business Continuity: Why Backups Alone Won't Keep Your Company Running, and What to Do This Week
Backups can bring systems back, but they do not keep work moving during the outage. Here is what Japan's IPA l...
Sshole SSH Vulnerability (CVE-2026-123158): Exploit Attempts Hit Honeypots, Which Alpine Linux Servers Are Exposed, and the Fixed Versions to Install
An OpenSSH flaw called Sshole can let attackers skip the password on some Alpine Linux servers, and honeypots...
