QNAP security notice published November 6, 2026; Plex disclosure of widespread attacks October 19, 2026
Patching Is Not Cleanup: QNAP Says Some NAS Plex Servers Are Already Compromised Through Plex2Shell
QNAP issued a security notice on November 6 stating that it has received reports from users whose Plex Media Server installations on QNAP NAS devices appear to have been compromised through Plex2Shell, and that its technical support team is assisting those users. Plex2Shell is four flaws in Plex Media Server 1.43.2 and earlier, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, each limited alone but chained into unauthenticated remote code execution with the privileges of the Plex process: the chain reaches internal functions, discloses the server owner administrator token, and writes a file into the Plex Codecs folder. Plex says a public proof of concept appeared on October 16 and that internet-facing servers that were not updated have since been widely attacked, with compromised servers used to run cryptocurrency miners and proxy software. QNAP is explicit about the boundary of the flaw: it lives in Plex Media Server, and QTS, QuTS hero, and other QNAP operating systems are not themselves affected. The fix is Plex Media Server 1.43.3, build 1.43.3.10861 or later, available in the QNAP App Center. The notice draws a hard line that owners must not miss: if Plex was reachable from the internet while running 1.43.2 or earlier, through Remote Access, a forwarded port 32400, or UPnP or router auto-configuration, updating closes the entry point but does not remove anything an attacker installed, and the NAS should be treated as potentially compromised, with a clean reinstall, indicator checks, and credential resets following the vendor FAQ. QNAP also advises preserving the Plex Logs folder before removing Plex if support help is wanted, signing out all devices before changing the Plex password because the administrator token may have been exposed, and disabling Remote Access or reaching Plex through a VPN instead.
Executives
A media server is easy to file as a home convenience, until it is running on the same NAS that holds backups, file shares, or business records. QNAP notice moves this from a patch item to an incident question for any exposed device: some customers are already compromised, and the vendor is helping them clean up. If your organization or your staff run Plex on QNAP hardware that was reachable from the internet, the decision to make is whether to treat those boxes as incidents now, while the vendor FAQ and support path are current, rather than as routine updates.
CIO / CISO
Scope it in two questions. First, inventory: which NAS devices run Plex Media Server, at what build, and was Remote Access, port 32400 forwarding, or UPnP exposure ever enabled while the build was 1.43.2 or earlier. Second, disposition: devices that were never internet-reachable need the update to 1.43.3.10861 or later; devices that were reachable need the compromise path, clean reinstall without restoring the old Codecs folder, indicator review, and rotation of Plex and NAS credentials plus any backup or cloud credentials stored on the device. Record which branch each device took and why.
Engineers
Follow the vendor sequence, not an improvised one. Preserve the Plex Logs folder before removal if QNAP support may investigate. Check the Codecs folder for unfamiliar files, watch for outbound connections to proxystream.st and for sustained high CPU with nothing playing, both named in coverage of the QNAP guidance, and confirm the installed build in Plex Web under Settings, General, not only in App Center. After cleanup, remove the exposure that made this possible: Remote Access off, no port 32400 forwarding, VPN for remote viewing.
Everyone (non-IT)
If you run Plex on a QNAP box at home, do this today: update Plex in App Center to version 1.43.3 or later. Then ask the one question that decides the rest: could anyone on the internet reach it, because you turned on Remote Access or your router opened the port automatically. If yes, updating alone is not enough; follow QNAP Plex2Shell FAQ for the clean reinstall and password resets, and sign out every device from your Plex account first. If you only ever watched at home on your own network, the update is the whole job.