QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.
The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices.
Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Security researcher Zach Main discovered and reported the flaws to Plex on July 27.
CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, giving it maximum priority.
QNAP’s NAS devices are specialized computers with built-in storage that allow users to store, access, and share files across a network.
Users can also expand their devices' capabilities by installing applications from the QNAP App Center, such as Plex Media Server, which streams movies, TV shows, and music directly from NAS drives.
QNAP says that users should treat their NAS devices and all personal content as compromised if they're running a vulnerable Plex server that is exposed on the public web.
Users who do not need to access Plex remotely should disable the related features and stop forwarding port 32400.
Exploitation started shortly after the full technical details became public on October 16; they are typically used to back up computers and store media files.
QNAP advises users to update Plex Media Server to the latest version available through the QNAP App Center, currently 1.43.3.10861, to protect against Plex2Shell attacks.
The recommended action is to check for the signs of compromise shared in the security bulletin , perform a clean reinstall of the OS (QTS or QuTS hero), and then reset Plex and NAS credentials.
QNAP has released a detailed step-by-step remediation guide on how to do the above.
The company also offers to investigate logs from suspected compromises, which users can submit via QNAP’s technical support portal.
What happened
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.
The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices.
Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
What changed
Security researcher Zach Main discovered and reported the flaws to Plex on July 27.
CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, urging federal agencies to upgrade to Plex 1.43.3.10861 or later within three days, giving it maximum priority.
Who is affected
QNAP’s NAS devices are specialized computers with built-in storage that allow users to store, access, and share files across a network.
Users can also expand their devices' capabilities by installing applications from the QNAP App Center, such as Plex Media Server, which streams movies, TV shows, and music directly from NAS drives.
Why it matters
QNAP says that users should treat their NAS devices and all personal content as compromised if they're running a vulnerable Plex server that is exposed on the public web.
Users who do not need to access Plex remotely should disable the related features and stop forwarding port 32400.
Technical details
Exploitation started shortly after the full technical details became public on October 16; they are typically used to back up computers and store media files.
QNAP advises users to update Plex Media Server to the latest version available through the QNAP App Center, currently 1.43.3.10861, to protect against Plex2Shell attacks.
Response
The recommended action is to check for the signs of compromise shared in the security bulletin , perform a clean reinstall of the OS (QTS or QuTS hero), and then reset Plex and NAS credentials.
QNAP has released a detailed step-by-step remediation guide on how to do the above.
What security teams should do
The company also offers to investigate logs from suspected compromises, which users can submit via QNAP’s technical support portal.
Attribution
BleepingComputer: QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.