QNAP says hackers breaching NAS devices in Plex2Shell attacks

QNAP is warning customers that its network-attached storage devices have been hit in attacks exploiting a chain of Plex Media Server flaws known as Plex2Shell, and it is directing users to patch the software through the QNAP App Center.

The vendor said it has received multiple reports from users who suspect their Plex Media Server installations on QNAP NAS devices were compromised through the vulnerabilities. QNAP Technical Support is working with the affected users, according to an advisory the company issued.

Plex2Shell is made up of four vulnerabilities in Plex Media Server tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Security researcher Zach Main found the flaws and reported them to Plex on July 27, and exploitation began soon after full technical details were published on October 16. CISA added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, telling federal agencies to move to Plex 1.43.3.10861 or later within three days at maximum priority.

QNAP's NAS products are storage computers that let users keep, reach and share files over a network, and are commonly used for computer backups and media libraries. Owners can add capabilities by installing applications from the QNAP App Center, including Plex Media Server, which streams movies, TV shows and music from NAS drives. QNAP is telling users to move Plex Media Server to the newest version in the App Center, currently 1.43.3.10861.

According to QNAP, its Product Security Incident Response Team has confirmed that the flaws exist only in Plex Media Server and that QTS, QuTS hero and other QNAP operating systems are not themselves affected.

QNAP said users running a vulnerable Plex server exposed to the public web should treat their NAS device and all personal content on it as compromised. The company cautioned that updating will not clear any payloads attackers have already placed on a device. Its recommended steps are to check the security bulletin for signs of compromise, do a clean reinstall of QTS or QuTS hero, and then reset Plex and NAS credentials.

Users who do not need remote Plex access should turn off the related features and stop forwarding port 32400, while those who require remote access should connect through a VPN, QNAP said. The company has published a step-by-step remediation guide and is offering to examine logs from suspected compromises submitted through its technical support portal.

More cybersecurity news from TechManNews.