QNAP Warns: Patch Plex After Plex2Shell Hits

If you run Plex Media Server on a QNAP NAS and that box can be reached from the internet, treat this as urgent. QNAP said today it is helping customers whose Plex installs look compromised through the Plex2Shell bug chain, and the fix in the App Center will not wipe anything attackers already dropped.

What happened

On November 6, 2026, QNAP published a security notice about Plex2Shell: four flaws in Plex Media Server 1.43.2 and earlier, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Alone each bug is limited; chained together they let an unauthenticated remote attacker run code as the Plex process. Plex has said a public proof of concept landed on October 16 and that internet-facing servers that stayed unpatched have been hit widely — including with crypto miners and proxy software that routes other people’s traffic through the victim’s line.

QNAP’s PSIRT says the holes live only in Plex Media Server. QTS, QuTS hero, and the rest of the NAS OS are not themselves affected. Still, QNAP has “received reports from some users” that Plex on their NAS appears compromised, and Technical Support is working those cases. BleepingComputer covered the notice the same day; their post on X is how a lot of people first saw it. CISA already put all four CVEs on its Known Exploited Vulnerabilities list on October 20 and told federal agencies to move to Plex 1.43.3.10861 or later within three days.

Why it matters

Home and small-office NAS boxes are exactly the devices people leave on 24/7 with Remote Access or a forwarded port “just so we can stream from the hotel.” Port 32400, Plex Remote Access, UPnP, and router auto-open tricks all count as internet-reachable in QNAP’s guidance. Photos, tax PDFs, and family video on that volume are then sitting behind a process that was remote-code-executable for weeks after the PoC went public.

Updating now closes the door. It does not remove miners, proxies, or other payloads that may already be on disk. QNAP is blunt: if a vulnerable Plex was reachable from the public web, treat the NAS and its content as potentially compromised and follow their clean-reinstall FAQ rather than hoping a patch alone is enough.

What to do

• Update Plex today. On the NAS open App Center → My Apps, update Plex Media Server to 1.43.3 or later, then in Plex Web go to Settings → General and confirm the build is 1.43.3.10861 or newer.
• Were you exposed? If Remote Access was on, port 32400 was forwarded, or UPnP/auto-config opened the port while you were still on 1.43.2 or earlier, follow QNAP’s Check and Remediation FAQ: look for their indicators of compromise, do a clean OS reinstall when advised, and reset Plex and NAS passwords. Preserve the Plex Logs folder before you remove Plex if you want QNAP Support to dig in.
• Shrink the attack surface. If you only stream at home, turn off Plex Remote Access and stop forwarding 32400. If you need remote playback, put the NAS behind a VPN instead of hanging Plex on the open internet. Keep QTS/QuTS hero and every App Center package current.
• Not on QNAP? The same Plex builds are still the ones that matter. Patch any internet-facing Plex host — Synology package, Docker, Windows, or a spare PC — and rethink direct port exposure the same way.

My take

This is the boring failure mode of home labs: a useful media app, a “temporary” port forward that never got removed, and a patch that sat in the App Center while people assumed the NAS OS being “unaffected” meant they were fine. QNAP’s wording is useful because it separates the OS from the app and still tells exposed users to rebuild. If your Plex was only on the LAN, update and breathe. If it was reachable from outside for any stretch after mid-October, assume someone already ran the PoC against you and rotate credentials after a clean install — not before you understand what is still listening.

If you are tired of babysitting a commercial media stack on a NAS, our Jellyfin home media server guide is the self-hosted path a lot of readers took last month, and pairing that with Tailscale or WireGuard beats opening 32400 to the world. Indian buyers on a QNAP TS-something under a desk should check App Center tonight; festival-season travel is exactly when Remote Access gets flipped on and forgotten.