Plex2Shell QNAP NAS Exploit: Attackers Compromise Plex Media Server on NAS Devices, the Fixed Version and How to Check Yours
QNAP says attackers have compromised Plex Media Server on some NAS devices using Plex2Shell, a four-flaw chain that needs no login. Here is the fixed version, how to tell if Plex was exposed, and the cleanup steps.
Where Worldwide
On this page 7 sections
Attackers are breaking into Plex Media Server on QNAP NAS devices through Plex2Shell, a chain of four flaws that lets someone with no login run code on the device. If your business keeps backups or shared files on a QNAP NAS that also runs Plex, update Plex this week and check whether it could be reached from the internet. Updating does not remove anything an attacker already installed.
What happened with Plex2Shell on QNAP NAS
On Friday, November 6, 2026, QNAP published a security notice saying some users had reported that Plex Media Server on their NAS appeared to be compromised. Plex Media Server is a third-party app installed from QNAP's App Center. QNAP's product security team (PSIRT) says the flaws are in Plex Media Server only, and that QTS and QuTS hero, QNAP's operating systems, are not affected.
The flaws were already public. On Monday, October 19, 2026, Plex posted on its forum that the vulnerabilities were "actively and widely exploited" against internet-facing servers that had not been updated. A public proof of concept had appeared on October 16. CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on Tuesday, October 20, 2026.
QNAP's notice is the new part. It confirms the attacks have reached Plex installs on QNAP NAS units, which many businesses use as a file server or backup target.
The four Plex2Shell CVEs
Plex says each flaw is limited on its own. Chained together, they let an unauthenticated remote attacker run code with the privileges of the Plex Media Server process.
| CVE | What Plex says it does |
|---|---|
| CVE-2026-96652 | Server-side request forgery in the player timeline endpoint, no login needed |
| CVE-2026-96654 | Access to internal agent functions over the loopback interface |
| CVE-2026-96655 | Leaks the server owner's admin token |
| CVE-2026-96656 | Writes arbitrary files to the Codecs folder through transcoder settings |
Affected: Plex Media Server 1.43.2 and earlier. Fixed: 1.43.3.10861 and later.
What is confirmed and what is not
What the primary sources confirm:
- Plex says unpatched internet-facing servers were attacked and that compromised servers were used to run cryptocurrency miners and proxy software.
- QNAP says users reported compromised Plex installs on their NAS devices. For those reported cases, QNAP says its Technical Support "has confirmed that no data loss has occurred."
- CISA lists all four CVEs as known to be exploited.
What those sources do not say:
- How many QNAP devices were hit. QNAP gives no number.
- Who is behind the attacks.
- Whether files were read or copied. QNAP's statement covers data loss in the cases it reviewed. It does not address whether anyone viewed the files.
- Who found the flaws. Plex's advisory does not name a researcher.
Both vendors take a cautious line. Plex says to treat anything the Plex service account could reach, such as mounted shares and stored credentials, as potentially exposed. QNAP's FAQ says the same about shared folders Plex could access and credentials stored on the NAS.
Why a Plex hack matters for a business NAS
A NAS often holds the files a business can't afford to lose: backups, shared drives, scanned documents, accounting exports. Plex tends to get added for a lobby screen or a training video library and then forgotten. Nobody owns it, so nobody updates it. We covered that pattern in Who Is Patching the Software That Runs Your Business?
The risk goes beyond video files. The chain runs code as the Plex process, and one of the flaws exposes the Plex admin token. Backup jobs on a NAS often store passwords or access keys for cloud storage, which is why QNAP tells owners to rotate them.
The flaws are in Plex Media Server itself, not in QNAP's software. Plex's advisory applies to any server running 1.43.2 or earlier, whether that is a Windows PC, a Linux server or another brand of NAS. QNAP is the NAS maker that has issued a warning.
How to check your QNAP NAS for Plex2Shell
Work through these steps this week, in this order.
| Step | What to do |
|---|---|
| Check the version | Look in App Center > My Apps, or in Plex Web under Settings > General. You need 1.43.3.10861 or later. |
| Update | Go to App Center > My Apps > Plex Media Server > Update. If no update appears, refresh App Center and confirm the NAS can reach the internet. |
| Decide if it was exposed | Treat the NAS as potentially compromised if, while it ran 1.43.2 or earlier, Plex Remote Access was on, your router forwarded port 32400, UPnP was on along with Remote Access, or Plex was exposed through myQNAPcloud auto router configuration. |
| Look for signs | Processes started by Plex named myawesomeproxy, mylovelyminer or x12345; unfamiliar .so or .dll files in the Codecs folder; outbound connections to proxystream.st; high CPU with nothing playing; a Malware Remover detection such as MR2104. |
| Save the logs | Before removing anything, copy the Plex Logs folder from the PlexData shared folder. QNAP needs it to help confirm a compromise. |
| Clean reinstall | Remove Plex in App Center. Do not reuse the old Plex Media Server folder in PlexData. At minimum, empty the Codecs folder and check Preferences.xml for transcoder settings you did not set. Then reinstall 1.43.3 or later. |
| Reset credentials | Plex: sign out all devices first, then change the password, because the admin token may be exposed. NAS: change admin and user passwords, turn on two-step verification, and rotate keys used by backup jobs and cloud connections. |
| Close the door | Turn off Plex Remote Access, remove the port 32400 forward, disable UPnP, and use a VPN such as QVPN Service for remote access. Turn on Malware Remover scheduled scans and QuFirewall. |
If you find signs of compromise, QNAP says not to just delete the suspicious program, because other components may remain. Do the clean reinstall and the credential reset. We explain why a fresh version does not undo an intrusion in Updated Is Not the Same as Patched.
On timing: neither the Plex nor the QNAP pages we read say when 1.43.3 first shipped. QNAP said version 1.43.5 would be available in App Center on November 9. Any build at 1.43.3.10861 or later has the fix.
Plex2Shell questions people are asking
Is QNAP QTS affected by Plex2Shell?
No. QNAP's PSIRT says the flaws are only in Plex Media Server and that QTS and QuTS hero are not affected. The NAS is at risk because Plex runs on it.
What version of Plex fixes Plex2Shell?
Plex Media Server 1.43.3.10861 and later. Version 1.43.2 and anything earlier is vulnerable.
Is updating Plex enough?
Only if Plex was never reachable from the internet. If it was, Plex and QNAP both say to assume it may be compromised, do a clean reinstall and reset credentials.
Does the Plex Media Server exploit need a password?
No. Plex says an unauthenticated remote attacker can use the chain.
Does Plex2Shell affect Synology or Windows Plex servers?
The flaws are in Plex Media Server, so Plex's advisory covers any server on 1.43.2 or earlier, whatever it runs on. Use the same version check and cleanup steps.
Was data stolen from hacked QNAP NAS devices?
QNAP says its support team confirmed no data loss in the cases reported to it. It does not say whether files were read or copied, so treat anything Plex could reach as potentially exposed.
The bigger lesson
A NAS gets treated like a storage box, but every app installed on it turns it into a server. Here, one media app left open for remote streaming put the device holding a company's backups within reach of anyone with a public exploit. Know what runs on each device, close the ports nobody needs, and keep remote access behind a VPN. If you run your own hardware, our self-hosting and infrastructure page explains how we set that up.
Want someone to check what your network exposes? See security hardening or get a quote.
Get security alerts like this by email, with our free checklist, at security alerts.
Sources: QNAP security notice on Plex2Shell; QNAP Plex2Shell check and remediation FAQ; Plex security update for Plex Media Server 1.43.2 and earlier; CISA adds six known exploited vulnerabilities to catalog.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store atta...
Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week
Attackers changed refrigeration settings at about 700 French retail sites in October, and US agencies now urge...
Iris Ohyama Data Breach: Data on 7.7 Million Iris Plaza Customers May Have Leaked From a Cloud Service, What Is Confirmed and What to Check
Iris Ohyama says a third party got into an external cloud service used by its Iris Plaza online store, putting...
