QNAP warns Plex2Shell attacks are hacking NAS devices - 2

QNAP, the maker of and office network storage boxes, says hackers have broken into some of its customers' devices through a set of flaws in Plex Media Server, the popular app for streaming your own movies and music. [1] If you run Plex on a QNAP NAS and have ever made it reachable from the internet, the company now wants you to treat the whole box, and everything stored on it, as compromised.

The attack chain is nicknamed Plex2Shell. It strings together four bugs, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, so that a stranger on the internet can run commands on the server without knowing any password. [2] QNAP published its warning on November 6, saying it had received reports from users that their Plex installation on a NAS looked hacked. [1]

QNAP did not say how many devices were hit. Its security team added that its own operating systems, QTS and QuTS hero, do not contain the flaws. The weakness sits only in the Plex app, which owners add through the QNAP App Center. [1]

How the Plex2Shell flaws work

Each bug looks modest alone. Scores run from 5.3 to 8.6 out of 10, but together they reach 9.8, which counts as critical. [4] One flaw lets an outsider make the server send requests on their behalf. Another tricks a function into handing over the owner's admin token. A third pulls an attacker's file onto the machine, and the last lets that file be saved in a folder where Plex loads it as code. [3]

The result is code running with the privileges of the Plex service. On a NAS that usually means access to every shared folder the service can read.

Timeline: from a quiet fix to active attacks

Researcher Zach Main told Plex the bugs on July 27. [3] Sources differ on the exact fix date: The Hacker News says August 3, while BleepingComputer says August 4. Both agree the patched build is 1.43.3.10861. [3] [4] Full details went public on October 16, and attacks followed the day. [2]

On October 20 the US cyber agency CISA added all four flaws to its list of bugs known to be exploited and told federal agencies to update within three days. [1] The gap between that warning and QNAP's notice shows how slowly updates can reach boxes that sit in a closet.

What the attackers installed

A researcher running a decoy Plex server saw the first real attacks drop two programs. One was a coin miner based on the XMRig tool, which burns your processor and electricity to earn cryptocurrency for someone else. The other was a proxy program called myawesomeproxy, which can route a stranger's internet traffic through your connection. [2] [3]

The proxy matters because it makes your address look like an ordinary user. The researcher warned that servers on residential connections could become a doorway to company VPNs and email accounts. [2] You can read how miners behave in our guide to the XMRig miner and the Trojan.Win64.Miner.gen detection. A similar family is covered under BV:Miner-T .

What QNAP says to do now

QNAP's advice is blunt: "QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised." [1] It says installing the update does not delete anything an attacker already planted, so patching is only the first step.

Open the QNAP App Center and update Plex Media Server to 1.43.3.10861 or newer.

Check your NAS against the signs of compromise in QNAP's security bulletin.

If the server was reachable from the internet, back up the files you need and reinstall QTS or QuTS hero from scratch.

Change your Plex password and every NAS account password afterward.

If you do not need remote streaming, turn it off and stop forwarding port 32400 on your router.

If you do need it, reach your network through a VPN instead of an open port.

Anyone running a Plex Media Server older than 1.43.3.10861 is exposed, whether it lives on a QNAP box, a Windows or Linux computer, or a Docker container. [4] The QNAP warning is NAS owners, but the same Plex flaws apply elsewhere. Servers that are only used inside your network are far less likely to be reached, though they should still be updated.

A NAS often holds family photos, scanned documents and backups, so a break-in is more serious than a lost movie library. If you see slow performance, unfamiliar processes or fans running hard, take that as a reason to check the box.

QNAP says its support team is helping affected users and will look at logs sent through its technical support portal. It also published a step by step remediation guide. [1] Plex had not answered The Hacker News's request for when that outlet published in October. [3]

Expect more reports. Public exploit code is available, scanners look for open Plex ports around the clock, and many NAS owners do not check for app updates. Make a habit of opening your package manager once a month.

Frequently asked questions

It is the nickname for a chain of four flaws in Plex Media Server that lets an attacker run code on the server without logging in.

No. QNAP says the bugs are in Plex Media Server only, and that QTS and QuTS hero are not affected.

Version 1.43.3.10861 or later. Sources disagree on whether it was released on August 3 or August 4.

No. QNAP says an update does not remove files an attacker already installed, so check the device and consider a clean reinstall.

In the observed attacks they installed a cryptocurrency miner and a proxy program that can pass other people's traffic through the victim's connection.

QNAP suggests turning off remote features you do not need and using a VPN for the rest, instead of leaving port 32400 open.

No yet. Be the first.