QNAP says Plex is the way into its NAS boxes. Updating will not clean them.
By Lior AharonovFounder, 7IT Solutions ·
What happened
QNAP says it has reports of Plex Media Server compromised on users' NAS devices through Plex2Shell, a chain of four flaws (CVE-2026-96652, 96654, 96655 and 96656) that CISA added to its exploited list on 20 October. Plex 1.43.3.10861 fixes them, but QNAP warns the update will not remove payloads already installed, per BleepingComputer.
Why it matters
The NAS in the office closet often holds the backups, the contracts and the shared drive. If Plex on it faced the internet, QNAP says to treat the whole box as compromised, not just the media app.
What to do
If Plex ran exposed on your QNAP NAS, do a clean reinstall of QTS or QuTS hero, reset Plex and NAS credentials, stop forwarding port 32400, and use a VPN for remote access.
My take
Lior Aharonov
Founder, 7IT Solutions
Patching closes the door. It does not throw out whoever already walked in. After an exploited flaw, rebuild first and trust later.
Sources
| BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.