QNAP has warned that hackers are breaching its customers' network-attached storage devices through a chain of flaws in Plex Media Server known as Plex2Shell. In a security notice published on 6 November, the storage maker said it had received reports from users whose Plex installation on a NAS appeared to have been compromised, and its technical support team is assisting those affected.

Plex2Shell combines four vulnerabilities in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together, they let an attacker with no account on the server run commands remotely, without knowing any password. Security researcher Zach Main reported the flaws to Plex on 27 July, and exploitation began shortly after full technical details became public on 16 October.

Patch alone will not clean an infected device

The flaws affect Plex Media Server 1.43.2 and earlier, and the fix is version 1.43.3.10861 or later, available through the QNAP App Center. QNAP stressed that the flaws sit only in the Plex app, not in its own operating systems QTS and QuTS hero. But the company warned that updating alone will not remove malware already installed, and anyone who exposed a vulnerable Plex server to the internet should treat the whole NAS, and everything stored on it, as compromised.

What attackers do with hacked servers

Plex disclosed widespread attacks on 19 October, three days after proof-of-concept code appeared. Attackers have used compromised servers to run cryptocurrency miners and proxy software that routes other people's traffic through victims' internet connections. The US Cybersecurity and Infrastructure Security Agency added all four flaws to its Known Exploited Vulnerabilities catalogue on 20 October, urging federal agencies to update within three days. Owners should update Plex immediately, then check for signs of compromise and reset credentials.