Four Flaws. One Open Door.
Your movie collection lives on a little box in your home. This week, QNAP confirmed that box is being broken into. Hackers are actively exploiting a chain of four vulnerabilities in Plex Media Server — the app many people run on their QNAP storage devices to stream films, TV, and music — and the company has received multiple reports of suspected compromises from its own customers.
The chain is called Plex2Shell, and it is not theoretical. Exploitation started the day after the technical details went public, and the U.S. government has already put all four flaws on its list of vulnerabilities known to be exploited. If you run Plex on a QNAP device and it is reachable from the internet, this one is about you.
What happened
QNAP published its advisory on Friday, November 6. The company’s security team said it had received reports from users that Plex Media Server on their storage devices appeared to have been compromised through the Plex2Shell vulnerabilities, and that its technical support team is assisting the affected users.
Plex2Shell is a chain of four vulnerabilities in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Chained together, they let a remote attacker run code on the server without a password. Security researcher Zach Main discovered the flaws and reported them to Plex on July 27. The fix was ready within days — but exploitation started shortly after the full technical details became public on October 16.
On October 20, the U.S. Cybersecurity and Infrastructure Security Agency added all four flaws to its Known Exploited Vulnerabilities catalog, giving them maximum priority and ordering federal agencies to upgrade to Plex 1.43.3.10861 or later within three days.
QNAP is clear about where the flaws live: they exist only in Plex Media Server. The company’s own operating systems — QTS, QuTS hero, and the rest — are not themselves affected. But that distinction matters less than it sounds. The storage box is the thing holding your backups, your photos, and your documents, and the media server running on it is the way in.
Why it matters
A storage box is not like a laptop. It is always on, it is often reachable from the internet so you can reach your files from anywhere, and it holds the copies of things you cannot afford to lose — family photos, backups, documents. When attackers get code execution on one, they get the keys to the household’s digital archive.
The timeline is the other warning. The flaws were reported in July and fixed in early August, yet the attacks only started in mid-October, when the details went public. That is the pattern of modern exploitation: the patch exists, the proof of concept lands, and the window between “public” and “attacked” is measured in hours. We saw the same shape this week with an OpenSSH flaw that drew its first exploitation attempt within nine hours of disclosure — and with a SonicWall firewall flaw that is already being exploited in the wild. The gap between a published fix and a working attack keeps shrinking, and home equipment is not exempt from it.
And then there is QNAP’s bluntest line: updating now will not remove any payloads the attackers have already installed. A patch closes the door. It does not evict whoever already walked through it. Anyone who ran a vulnerable Plex server exposed to the internet has to assume the box is compromised and clean it properly — not just click update and move on.
What to do now
1. Update Plex Media Server to 1.43.3.10861 or later. Get it through the QNAP App Center, not from a random download. This closes the four flaws and stops new attacks.
2. If your Plex server was reachable from the internet on an older version, assume it is compromised. Check for the signs of compromise in QNAP’s security bulletin and step-by-step remediation guide, and if anything looks off, contact QNAP technical support — the company says it will investigate logs from suspected compromises submitted through its support portal.
3. Reinstall clean and reset everything. QNAP’s recommended path is a clean reinstall of the operating system (QTS or QuTS hero), followed by resetting Plex and NAS credentials. It is more work than an update, but it is the only way to be sure nothing the attackers installed is still hiding on the box.
4. Decide whether Plex needs to be reachable at all. If you do not need remote access, disable the related features and stop forwarding port 32400 — the port Plex uses for remote access. If you do need it, connect through a VPN instead of exposing the server directly to the internet. Every port you forward is a door you have to defend.
The fix has been available since August. The attacks started in October. The warning arrived in November. If your storage box is still running an old Plex, the order of operations is simple: update it, check it, and if it was ever exposed, clean it as if someone already got in — because, for some QNAP owners, someone did.