Synology has issued a new security advisory for the Plex2Shell vulnerabilities in its Plex Media Server package, publishing fixed versions for its NAS devices. The advisory, released on 8 November, comes two days after rival NAS maker QNAP said some of its users' Plex installations appeared to have been compromised through the same flaws.

Plex2Shell is a chain of four vulnerabilities in Plex Media Server that, taken together, let an unauthenticated remote attacker run code with the privileges of the Plex server process. Plex confirmed on 19 October that the flaws were being actively and widely exploited, and the US cybersecurity agency CISA added all four to its catalogue of exploited vulnerabilities on 20 October.

Synology's fixed packages

Synology's advisory, SA-26:17, covers the Plex Media Server package in its DiskStation Manager software, not DSM itself. For DSM 7.4 and 7.3, the fixed release is Plex Media Server 1.43.5.11079-720011079 or later. For DSM 7.2.2 and 7.2.1, it is 1.43.5.11079-700011079 or later. Synology rates all four vulnerabilities as important.

The four flaws are CVE-2026-96652, a server-side request forgery flaw; CVE-2026-96654, which lets an attacker call other plug-ins' functions; CVE-2026-96655, another request-forgery flaw in the transcoding path; and CVE-2026-96656, which lets an admin user write arbitrary files that may be executed when loaded. The underlying Plex server itself was fixed in version 1.43.3.10861, released in August, but NAS app stores publish packages on their own schedules, which is why Synology's package update has only now arrived.

Synology's advisory does not report any compromised Synology systems. Its guidance is preventive: upgrade the package to the fixed release.

QNAP reports suspected compromises

QNAP's notice, issued on 6 November, is more urgent. The company said it had received reports from some users that Plex Media Server on their NAS appeared to have been compromised, and that its technical support team was assisting the affected users. QNAP confirmed the vulnerabilities exist only in Plex Media Server itself, and that its QTS and QuTS hero operating systems are not affected.

According to Plex, a public proof of concept for the flaw chain was released on 16 October, and internet-facing servers that had not been updated have since faced widespread attacks. Compromised servers have been used to run cryptocurrency miners and proxy software.

QNAP's advice goes beyond updating. If Plex on a NAS could be reached from the internet while running version 1.43.2 or earlier, for example through Plex Remote Access, a forwarded port 32400, or automatic router configuration, QNAP says the device should be treated as potentially compromised. Updating alone will not remove anything an attacker may already have installed. Owners should follow QNAP's clean-reinstall and remediation guidance, check for signs of compromise, and reset their Plex and NAS credentials.

What NAS owners should do

Anyone running Plex Media Server on a Synology or QNAP NAS should update to the fixed package now and confirm the version number in Plex's settings. If the server was reachable from the internet on an older version, the safe assumption is that it may have been compromised, and a clean reinstall plus credential resets are needed rather than a simple update.

Owners who do not need remote access should switch off Plex Remote Access and stop forwarding port 32400. Those who do need remote access should use a VPN instead of exposing the port directly. The NAS operating system and all installed apps should also be brought up to date.

The episode is a reminder that the media server on a home or office NAS is internet-facing software, not just a local appliance. A NAS often holds backups, documents and photos alongside the media library, so a flaw in an add-on package can put far more than a film collection at risk.