If you run Plex Media Server on a QNAP NAS, the update you may already have installed answers only half of the problem. QNAP says some of its customers appear to have been compromised through a set of flaws in Plex, BleepingComputer reports, and that updating now will not remove anything an attacker has already put on the device. QNAP's advisory itself couldn't be checked directly, so its statements here come through BleepingComputer.
Here is what is happening, in order, and what it means for you.
What Plex2Shell is
Plex2Shell is the name for a chain of four vulnerabilities in Plex Media Server, the app that streams movies, TV shows and music from your own storage. A chain means the flaws are used together, each one setting up the next.
CISA, the US cybersecurity agency, lists the four as CVE-2026-96652 and CVE-2026-96655, both server-side request forgery flaws; CVE-2026-96654, involving encoded URI schemes in a web page; and CVE-2026-96656, which concerns external control of a file name or path. It added all four to its Known Exploited Vulnerabilities catalog on October 20, based on evidence of active exploitation.
BleepingComputer reports that security researcher Zach Main found the flaws and reported them to Plex on July 27, and that exploitation began shortly after full technical details became public on October 16.
Why QNAP is involved
The flaws are not in QNAP's software. BleepingComputer quotes the company's security team as confirming that the vulnerabilities "exist only in Plex Media Server" and that QTS, QuTS hero and its other operating systems aren't themselves affected.
The connection is where Plex runs. QNAP's NAS devices are small computers with built-in storage, and owners can add apps from the QNAP App Center, including Plex Media Server. QNAP says it "has received reports from some users that Plex Media Server on their NAS appears to have been compromised" through these flaws, and that its technical support team is assisting them.
Note what that does and doesn't say. QNAP is describing reports from some users, not a count of affected devices.
Why updating isn't the end of it
An update closes the way in. It does not undo a break-in that has already happened. QNAP warned that updating won't remove payloads attackers have already installed, according to BleepingComputer.
So the question depends on your setup. BleepingComputer says QNAP advises treating the NAS and all personal content as compromised if you ran a vulnerable Plex server exposed to the public web.
What to do
When BleepingComputer published, the latest version in the QNAP App Center was 1.43.3.10861. From there, the steps it reports are:
- Update Plex Media Server to that version or later.
- Check for the signs of compromise listed in QNAP's bulletin.
- If your server was exposed, do a clean reinstall of the operating system (QTS or QuTS hero), then reset your Plex and NAS credentials.
- If you don't need remote access, disable the related features and stop forwarding port 32400.
- If you do need remote access, connect through a VPN.
Step three is the expensive one, so read QNAP's community FAQ on Plex2Shell for the exact procedure before you wipe anything. QNAP also offers to examine logs from suspected compromises through its support portal.
The vulnerable software is Plex itself, so owners running it on other hardware should check their version too. CISA gave US federal agencies three days to move to 1.43.3.10861 or later, BleepingComputer reports. That deadline doesn't apply to home users, but CISA does encourage all organizations to prioritize fixing flaws in its catalog.
Reporting notes
