Plex2Shell QNAP NAS Attacks: Patching Is Not Enough
The Plex2Shell QNAP NAS attacks are real enough that QNAP has issued its own advisory: users report compromised devices, and updating Plex does not remove what attackers already installed. Plex 1.43.3.10861 fixes the flaws, but a NAS that ran Plex 1.43.2 or older while reachable from the internet needs more than an update.
What Happened in the Plex2Shell QNAP NAS Attacks
Plex2Shell is a chain of four flaws in Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. heise rates three as medium and CVE-2026-96656 as high; chained, they let attackers run code on the server. Researcher Zach Main reported them to Plex on July 27, and exploitation started shortly after the full technical details became public on October 16 (per BleepingComputer). CISA added all four to its Known Exploited Vulnerabilities catalog on October 20.
On November 6, QNAP published an advisory on the Plex2Shell QNAP NAS attacks. It says some users reported that Plex on their NAS appears to have been compromised, and its PSIRT confirmed that the flaws are in Plex Media Server only; QTS and QuTS hero are not affected. Plex reports active and widespread exploitation, and heise adds that attackers use hijacked servers to run crypto miners and proxy software. As of November 6, 1.43.3.10861 is the current version in QNAP’s App Center; all earlier versions are described as vulnerable.
QNAP’s warning is specific. If Plex 1.43.2 or older was reachable from the internet, through Plex Remote Access, a forwarded port 32400 or UPnP, treat the NAS as potentially compromised. The update does not remove payloads that are already installed. QNAP’s remediation guide covers the indicators to look for, a clean reinstall and credential resets. BleepingComputer describes a reinstall of the NAS operating system, heise a clean reinstall of Plex, so follow the guide for your model.
Why It Matters
A NAS holds the backups and file shares. A media server installed on it for convenience, with remote access switched on, puts a consumer application next to business data and outside the software inventory and the update process. Assumption: small offices and branch sites often run exactly this setup, installed by whoever set up the NAS. The payloads reported so far are miners and proxy software, but a foothold on a NAS also reaches whatever the NAS can reach.
This is an asset inventory problem as much as a patching one. NIS2-covered organisations are expected to know which software runs on systems that hold their data, and “someone installed Plex” does not appear in most inventories. We covered the same risk from outdated NAS software in our Synology NAS ransomware post last week.
What You Should Do Now
- Find every NAS that runs Plex Media Server and update it to 1.43.3.10861 or newer through the App Center. If nobody needs Plex for work, uninstall it.
- Check whether Plex was reachable from the internet: Plex Remote Access, a forwarded port 32400, UPnP on the router. Switch these off. If you need remote access, put it behind a VPN.
- If Plex 1.43.2 or older was reachable, treat the NAS as compromised. Follow QNAP’s remediation guide, then change the Plex and NAS credentials and any credentials stored on the device. Updating alone does not undo an earlier compromise.
- Look for unexplained CPU load and unknown outbound connections from the NAS, the signs of the miners and proxy software reported so far.
DIESEC Perspective
Plex is this week’s example; the pattern is any convenience app with an internet-facing port on a device that holds business data. A workable minimum is a list of what runs on each NAS and which ports the router forwards to it. Both take an hour and answer most of the audit questions.
Not sure what runs on your NAS devices or which ports reach them? Contact DIESEC for an exposure review of your storage and remote access.
Sources: BleepingComputer | heise | CISA KEV catalog
Published: 2026-11-11 | Category: Vulnerabilities & Patches | ~4 min read
