Global News | November 11, 2026

Plex2Shell QNAP NAS attacks have put network-attached storage users on alert after QNAP said it received reports that Plex Media Server installations on some customers’ devices appeared to have been compromised through a group of security vulnerabilities.

The flaws are in Plex Media Server, a third-party application that can run on QNAP NAS devices, not in QNAP’s QTS or QuTS hero operating systems themselves. Plex says the vulnerabilities are being actively exploited against unpatched, internet-facing servers and recommends upgrading to a fixed release.

The four vulnerabilities, collectively known as Plex2Shell, can be chained to allow an unauthenticated remote attacker to run code with the privileges of the Plex Media Server process, according to Plex. A fix is available in Plex Media Server 1.43.3.10861 and later.

QNAP says its support team assisted users who reported apparent compromises and confirmed no data loss in the cases it described. That is not proof that every exposed installation is safe, or that all affected users everywhere experienced the same outcome. A device can require investigation even after its software has been updated.

What Happened in the Plex2Shell QNAP NAS Attacks?

Plex Media Server lets users organize and stream media stored on a computer, NAS or other supported device. The application may be reachable remotely when owners enable remote access or configure network forwarding. That convenience can also expose a vulnerable installation to the internet.

In a November 6 security notice, QNAP urged NAS users to update Plex Media Server after receiving reports from some users that their installations appeared to have been compromised. The company stated that the vulnerabilities exist in Plex Media Server and not in QNAP’s own operating systems.

Plex has separately said it observed widespread attacks against internet-facing servers that had not been updated after public proof-of-concept code was released on October 16. Plex reported that compromised servers had been used to run cryptocurrency miners and proxy software.

Reports of Plex2Shell QNAP NAS attacks must be separated from observations about vulnerable Plex servers generally. They do not establish that every reported QNAP case involved a miner, proxy software, stolen files or a particular attacker. QNAP did not disclose a total number of affected customers in the notice reviewed for this article.

Which Vulnerabilities Are Involved?

Plex identifies four vulnerabilities in the Plex2Shell chain:

1. CVE-2026-96652: An unauthenticated server-side request forgery issue in the player timeline endpoint.
2. CVE-2026-96654: Access to internal agent functions through the loopback interface.
3. CVE-2026-96655: Disclosure of the server owner’s administrator token.
4. CVE-2026-96656: An arbitrary file-write issue involving transcoder preferences and the Codecs directory.

Plex says the issues can be chained to let an unauthenticated remote attacker execute code with the privileges of the Plex Media Server process. An exploit chain combines separate weaknesses; it is not necessary to claim that each individual flaw independently gives an unauthenticated attacker full control.

The privileges available after exploitation depend on how the Plex process is configured. Code running as the application may be able to access resources available to that account, but the public advisory does not establish that every successful exploit automatically gains administrator or root access to a NAS.

The Plex2Shell QNAP NAS attacks highlight the difference between an application vulnerability and a flaw in the underlying operating system. Even where QTS and QuTS hero are not themselves affected by these four vulnerabilities, an exposed, vulnerable application on a storage device can still create a security problem for its owner.

A Timeline of the Disclosure and Response

Plex released a fixed version of Plex Media Server before the public exploitation reports. On September 1, Plex advised server owners to update and said that security identifiers would follow. It also warned that NAS package managers might not immediately contain the updated release.

According to Plex’s later advisory, public proof-of-concept material appeared on October 16. Plex subsequently reported widespread attacks against internet-facing servers that had not been updated, along with observed use of compromised systems for cryptocurrency mining and proxy software.

On October 19, Plex published an update identifying the four CVEs and confirmed that Plex Media Server 1.43.3.10861 and later are not affected by the described issues. The advisory urged owners of older, internet-reachable servers to assume their systems may have been compromised.

On November 6, QNAP issued its notice for NAS customers. SecurityWeek and heise online reported on QNAP’s warning on November 9. The availability of a fix before the QNAP notice is important: exploitation can continue when owners are unaware of a vulnerable application or have not installed an available update.

Who Is Affected and Which Version Is Fixed?

Plex says builds before 1.43.3.10861 are affected and that 1.43.3.10861 and later are not affected by these vulnerabilities. Owners should check the complete build number, not just whether the application is labeled 1.43.3. An earlier build in the same release series should not be assumed to contain the fix.

For Plex2Shell QNAP NAS attacks, the relevant question is whether a device runs an affected Plex Media Server installation and whether it was reachable by an attacker. QNAP identifies Plex Media Server 1.43.2 and earlier in its warning and recommends confirming that the installed build is 1.43.3.10861 or later.

QNAP says the fixed Plex release is available in its App Center. Owners can open App Center → My Apps, update Plex Media Server and check the full version in Plex Web → Settings → General. Availability and installation steps can vary; use current instructions from QNAP and Plex for the device in question.

Plex also runs on platforms other than QNAP. The broader Plex advisory applies to vulnerable Plex Media Server builds regardless of the platform, but this article focuses on QNAP’s notice and does not suggest that other NAS manufacturers reported the same customer incidents.

A device with no Plex Media Server installed is not exposed to these Plex-specific flaws through that application. Conversely, keeping QNAP’s operating system current does not by itself prove that an installed third-party application has been updated.

Seven Critical Risks for NAS Users

The following are possible consequences of a successful compromise or an exposed vulnerable system. They are not a list of outcomes confirmed in every case of Plex2Shell QNAP NAS attacks.

1. Unauthorized code execution: Plex says the chained vulnerabilities can allow remote code to run with the Plex process’s privileges. The exact access available depends on the local configuration.
2. Cryptocurrency mining: Plex has reported that some compromised servers were used to run miners. Unexpected processing load can be a reason to investigate, but it is not conclusive evidence of this specific exploit.
3. Proxy abuse: Plex also observed proxy software on compromised servers. Such software can route other people’s traffic through a victim’s connection, potentially creating bandwidth or security concerns.
4. Exposure of accessible data: A compromised application process may be able to read or modify files that its account is permitted to access. QNAP’s statement that it confirmed no data loss in the cases it described should not be generalized into a guarantee for all installations.
5. Credential or token exposure: One vulnerability concerns disclosure of the Plex server owner’s administrator token. Owners should follow vendor guidance on account and credential resets when a system may have been compromised.
6. Persistent attacker changes: Installing an update closes the identified vulnerability but does not necessarily remove unwanted software or changes already made during a compromise. An exposed system may need a separate investigation and recovery process.
7. Disruption during recovery: Isolating a NAS, checking backups and rebuilding affected components may interrupt media access or other services. The extent depends on the device and its role; the public reports do not establish disruption for every user.

The existence of these risks does not prove that any particular customer’s files were stolen, that all NAS accounts were taken over or that a specific actor was responsible.

What Should QNAP and Plex Users Do?

To respond to Plex2Shell QNAP NAS attacks, first inventory devices that run Plex Media Server and record the installed build. Update vulnerable installations to 1.43.3.10861 or later, using the QNAP App Center or the current vendor-supported installation method. Verify the build after installation rather than assuming that an update completed successfully.

Next, assess exposure. Determine whether the vulnerable service was reachable from the internet, including through Plex Remote Access, router port forwarding or automatic router configuration. A device that is no longer publicly reachable may still have been exposed earlier.

Plex’s advice is clear for an older server that was internet-reachable: assume it may have been compromised. Disconnect or isolate a suspected device as appropriate, preserve relevant logs if an investigation is needed, and follow the current guidance from Plex and QNAP. If the device contains business data or sensitive records, involve an incident-response professional before making changes that could destroy evidence.

QNAP and heise advise additional recovery steps for potentially compromised systems, including checking for signs of compromise, reinstalling Plex as directed and changing Plex and NAS credentials. Consult the vendor’s current instructions to determine whether a clean operating-system reinstall or other recovery measures are appropriate for the exposure and evidence. Updating the application alone is not proof that an already compromised system has been cleaned.

Review backups before relying on them. Check that copies are available, were created before any suspected compromise and can be restored safely. Do not assume that a backup is trustworthy merely because it exists. Owners should also review other accounts and systems to which the NAS had legitimate access.

Finally, reduce unnecessary exposure. If remote access is not needed, disable it and remove unneeded port-forwarding rules. If remote access is required, follow the vendors’ current secure-access recommendations and maintain a tested update process for both the NAS operating system and installed applications.

What Remains Unknown?

QNAP’s public notice says some users reported apparent compromises, but it does not provide a total number of affected devices, identify the attackers or establish that every user experienced the same activity. Its statement about no data loss relates to the cases its support team described; it is not a worldwide assessment of all Plex installations.

Plex has described widespread exploitation and specific observed payload types, but these general observations should not be attributed automatically to each reported QNAP case. The location, duration and full effect of an intrusion require evidence from the affected environment.

Users investigating Plex2Shell QNAP NAS attacks should distinguish a vulnerable version, internet exposure, attempted exploitation and confirmed compromise. Each is meaningful, but they are not interchangeable findings.

Conclusion

The Plex2Shell QNAP NAS attacks show why security maintenance must cover applications as well as the devices that host them. Plex confirms active exploitation and provides a fixed build, while QNAP has reported apparent compromises involving some customer installations.

Owners should update Plex Media Server, check whether vulnerable instances were exposed and investigate potentially compromised systems using current vendor guidance. A successful update is an important step, but it cannot by itself establish that an earlier intrusion did not occur.

Source note: This article draws on Plex’s security advisory, QNAP’s security notice as reproduced on QNAP Community, and reporting by SecurityWeek and heise online. The original QNAP notice URL redirected during the latest check; verify its current location before publication.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.