Malware · Vulnerabilities
QNAP NAS devices targeted by Plex2Shell malware exploiting Plex flaws
Attackers are exploiting four fixed flaws in Plex Media Server to take over QNAP NAS devices. Users running old Plex versions are urged to update and check for compromise.
Ross Grant2 min read
The short version
Attackers have found a way to break into QNAP NAS devices by exploiting old versions of Plex Media Server. If your NAS is connected to the internet and running an outdated Plex, it could be taken over by criminals. The fix is to update Plex, but if your device was exposed, you should also check for signs of compromise and reset your passwords. This shows why keeping software up to date is important, especially for devices accessible from the internet.
By the numbers
- 4number of Plex Media Server vulnerabilities exploitedTechRadar
- tens of thousandsestimated QNAP NAS devices accessible onlineTechRadar
- 3 daysCISA patch deadline for US federal agenciesTechRadar
What happened?
Attackers are exploiting four vulnerabilities in Plex Media Server to take over QNAP NAS devices, according to TechRadar. The flaws, called Plex2Shell, were fixed in September 2026, but attacks began after a proof-of-concept exploit was released. Plex and US authorities urge users to update and check for compromise if their NAS was accessible from the internet.
How the flaw works
According to TechRadar (opens in a new tab), four vulnerabilities in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) can be chained together to let attackers run any code they want on QNAP NAS devices. This means someone with no login details can take over the device remotely if it is accessible from the internet and running an old Plex version. The flaws, nicknamed "Plex2Shell", were fixed by Plex in September 2026 (version 1.43.3.10861), but a proof-of-concept exploit was released soon after, and attacks began in the wild.
Who is affected
QNAP NAS (Network Attached Storage) devices are used by both consumers and businesses to store and share files over a network. Many users install Plex Media Server on their NAS to stream media. Only devices running vulnerable versions of Plex Media Server and accessible from the internet are at risk. The QTS and QuTS operating systems themselves are not affected, according to Plex. BitSight estimates there are tens of thousands of QNAP NAS devices accessible online, but not all run Plex.
How the attack worked
Attackers have used the Plex2Shell flaws to install malware on QNAP NAS devices. Most reported cases involve installing proxy software or cryptocurrency miners. Proxy malware lets criminals route their traffic through the infected NAS, hiding their identity and enabling attacks like Distributed Denial of Service (DDoS). Cryptocurrency miners are less effective on NAS hardware, but still appear in some attacks.
The response
Plex released a patch in September 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) added all four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on 20 October 2026, giving US federal agencies three days to patch or stop using Plex. Plex says that if a NAS was accessible from the internet and running an old version, updating alone is not enough: users should do a clean reinstall, check for compromise, and reset credentials. The fixed version is available from QNAP's App Center.
What you should do
If you use Plex Media Server on a QNAP NAS, update to version 1.43.3.10861 or later immediately. If your device was accessible from the internet and running an older version, follow Plex's advice: perform a clean reinstall, check for signs of compromise, and change all passwords. Even if you do not use Plex, check your NAS for any unexpected software or activity, as attackers may try other routes.
Why it matters
QNAP NAS devices are popular for storing personal and business files. If compromised, attackers can steal data or use the device for further attacks. The incident highlights the risks of exposing devices to the internet and the importance of prompt patching.
Key points
- Four Plex Media Server flaws allow remote takeover of QNAP NAS devices.
- Attacks began after a proof-of-concept exploit was released.
- Plex fixed the flaws in September 2026; users must update to stay safe.
- If your NAS was internet-accessible and running old Plex, treat it as compromised.
- Proxy and crypto-mining malware have been seen in these attacks.
Sources
TechRadar
Reference
