QNAP: Plex2Shell attackers may have hacked NAS devices running Plex

QNAP says some of its customers' NAS devices appear to have been compromised through Plex2Shell, a chain of four flaws in the Plex Media Server app that lets an unauthenticated attacker run code on the server. In a security notice on Friday, the storage maker told anyone whose Plex server was reachable from the internet while running version 1.43.2 or earlier to treat the NAS as potentially compromised, because updating alone will not remove anything an attacker installed.

The flaws sit in Plex's software, not in QNAP's QTS or QuTS hero operating systems, QNAP says. Plex said on October 19 that the chain was being "actively and widely exploited" after a public proof of concept was released on October 16, and that compromised servers were being used to run cryptocurrency miners and proxy software that routes other people's traffic through the victim's connection. CISA added all four flaws to its Known Exploited Vulnerabilities catalogue on October 20.

How the chain works

Plex's advisory lists the four links. CVE-2026-96652 is an unauthenticated server-side request forgery in the player timeline endpoint. CVE-2026-96654 gives access to internal agent functions over the loopback interface, and CVE-2026-96655 discloses the server owner's admin token. CVE-2026-96656 allows an arbitrary file write to the Codecs directory through transcoder preferences. Each is limited on its own; chained, they give code execution with the privileges of the Plex Media Server process. Version 1.43.3.10861 and later are not affected. Plex released 1.43.3 on September 1, weeks before it published the CVE details.

Signs of compromise

Plex lists what to look for: processes started by Plex Media Server that the owner does not recognise, with names such as myawesomeproxy, mylovelyminer or x12345; unfamiliar .so or .dll files in the Plex Codecs folder; outbound connections to proxystream.st; and sustained high CPU use while nothing is playing.

What QNAP users should do

QNAP says to update Plex Media Server from App Center to 1.43.3 or later and confirm in Plex Web, under Settings and General, that the version is 1.43.3.10861 or later. If the server was exposed while on an older version, through Plex Remote Access, a forwarded port 32400 or a port opened automatically by UPnP, QNAP advises a clean reinstall, a check for indicators of compromise and a reset of Plex and NAS credentials, with steps in its remediation FAQ. Anyone who wants QNAP to confirm a compromise should keep the Plex Logs folder before removing the app and open a support case.

Plex adds that owners of a compromised server should sign out of all devices, change their Plex password and treat anything the Plex service account could reach, such as mounted shares and credentials on the same machine, as potentially exposed. Both companies advise turning off remote access if it is not needed; QNAP recommends a VPN where it is.

Neither company has said how many servers have been compromised. QNAP says it remains in contact with Plex and will update its notice.