By Hamza Faisal

QNAP has warned owners of its network storage devices that some of them may already have been hacked through a chain of flaws in Plex Media Server, nicknamed Plex2Shell — and that simply installing the patch will not undo the damage.

In a November 6 security notice, the storage maker said it had received reports from users that Plex Media Server running on their NAS devices "appears to have been compromised" through the vulnerabilities. QNAP is assisting the affected users, though the company has not said how many devices are involved.

The warning is the latest chapter in a flaw chain actively exploited for weeks. Plex says the four vulnerabilities are being "actively and widely exploited" against unpatched internet-facing servers.

Four flaws, one open door

Plex2Shell is a chain of four vulnerabilities in Plex Media Server 1.43.2 and earlier, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together, they let an attacker with no account on the server reach internal functions, steal the server owner's administrator token and write a file into Plex's Codecs folder — enough to run code on the machine.

Individually the flaws score between 5.3 and 8.6 out of 10; combined, researchers rate the chain at 9.8, the top of the critical range.

Security researcher Zach Main reported the bugs to Plex on July 27, and a fixed build — version 1.43.3.10861 — came in early August. But the flaws only became widely known when proof-of-concept details went public on October 16. Attacks followed within a day: researchers at Censys said their honeypots first saw exploitation on October 17, and Plex disclosed widespread attacks on October 19. On October 20, the US Cybersecurity and Infrastructure Security Agency added all four flaws to its Known Exploited Vulnerabilities catalogue, ordering federal agencies to patch within days.

Miners and proxies on hijacked servers

Attackers who break in have been using compromised servers to mine cryptocurrency and to run proxy software that routes other people's internet traffic through the victim's connection.

That is what makes QNAP's warning so pointed. Updating Plex closes the hole, but it does not delete anything an attacker has already planted. Anyone whose Plex server was reachable from the internet while running version 1.43.2 or earlier should treat the device as potentially compromised, even if the patch is now installed.

QNAP also drew a clear line around the blast radius: the flaws sit only in the Plex Media Server application, not in QNAP's own operating systems. QTS, QuTS hero and other QNAP operating systems are not affected, according to the company's product security team.

What owners should do now

QNAP's advice is straightforward. Open App Center, then My Apps, on the NAS and update Plex Media Server to version 1.43.3 or later. Then open Plex Web, go to Settings and then General, and confirm the build is 1.43.3.10861 or newer.

After that, owners should check whether their server was already hit. QNAP points users to its Plex2Shell Check and Remediation FAQ, which walks through the signs of compromise and the cleanup steps. The same warning applies beyond QNAP hardware: any Plex Media Server older than 1.43.3.10861 is exposed, whether it runs on a NAS box, a Windows or Linux computer, or in a Docker container.

The episode is a reminder of how quickly a patched flaw can turn into a live incident. The fix existed for more than two months before the details went public — but for servers that stayed unpatched and exposed, the window to act closed the day the proof of concept appeared.