QNAP confirms NAS breached via Plex2Shell; update Plex to 1.43.3.10861
Four flaws in Plex Media Server on QNAP NAS, dubbed Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), can be chained for unauthenticated remote code execution. QNAP has confirmed compromised devices, CISA lists the flaws as actively exploited, and hijacked servers were used to mine cryptocurrency and run proxy software. Update Plex to 1.43.3.10861 or later; anyone who ran an old version exposed to the internet should assume compromise, reinstall the OS, and reset passwords.
What happened
Attackers are breaking into QNAP storage devices by exploiting four Plex Media Server flaws collectively called Plex2Shell. QNAP has confirmed compromised devices and CISA lists the flaws as actively exploited. Hijacked servers were used to mine cryptocurrency and run proxy software.
Why it matters
The attack gives remote control of the server without a password, exposing every file stored on the NAS. Compromised devices are used for mining and proxy software, consuming company resources. According to QNAP, anyone who ran an old Plex version exposed to the internet should assume the device was compromised.
What to do
Update Plex Media Server to version 1.43.3.10861 or later now. If an old Plex version was exposed to the internet, reinstall the NAS operating system from scratch and reset both NAS and Plex passwords, because updating alone will not remove what attackers installed.
For the technical team
- CVE
- CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
- Affected
- Plex Media Server em NAS QNAP (conjunto de falhas Plex2Shell) · Plex Media Server installed on QNAP NAS, versions prior to 1.43.3.10861.
- Exploitation
- Active exploitation confirmed by QNAP, with reports of compromised devices; CISA lists the flaws as actively exploited. Compromised servers used to deploy cryptocurrency miners and proxy software.
- Fix
- Update Plex Media Server to 1.43.3.10861 or later (fix released in August according to IntCyberDigest). Updating alone will not remove malicious payloads: compromised devices require a clean operating system reinstall and resetting both NAS and Plex passwords.
- Vector
- Plex Media Server on QNAP NAS exposed to the internet; four chained flaws (Plex2Shell: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) allow remote code execution without authentication, no login required.
- More details
- QNAP advises customers who ran an old internet-exposed Plex server to assume their NAS has been hacked. Chaining the four flaws yields unauthenticated remote code execution.
Timeline
QNAP says customers who ran an old internet-exposed Plex should assume their NAS was hacked; compromised servers were used for crypto mining and proxy software.
Incident opened.
Sources 2 sources
- @DarkWebInformer @DarkWebInformer
- @IntCyberDigest @IntCyberDigest
