● Covered by 1 source · 1 reportMedium impact1 negative
QNAP NAS devices breached via Plex2Shell vulnerabilities; users urged to update Plex Media Server
Key points
- QNAP NAS devices are being compromised via Plex2Shell vulnerabilities.
- Plex2Shell is a chain of four vulnerabilities (CVE-2026-96652, -96654, -96655, -96656).
- Users must update Plex Media Server to version 1.43.3.10861 or newer.
- Compromised devices require OS reinstall and credential resets.
Plex2Shell Vulnerabilities Exploited
QNAP has issued an urgent advisory regarding ongoing attacks exploiting the Plex2Shell vulnerability chain to compromise its Network-Attached Storage (NAS) devices. The company has received multiple reports from users whose NAS devices, running Plex Media Server, appear to have been breached. The Plex2Shell chain consists of four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Discovery and Public Disclosure
Security researcher Zach Main discovered and reported these flaws to Plex on July 27. Technical details of the vulnerabilities became public on October 16, with exploitation commencing shortly thereafter. The Cybersecurity and Infrastructure Security Agency (CISA) added all four flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, mandating federal agencies to update to Plex 1.43.3.10861 or later within three days.
Impact on QNAP NAS Devices
QNAP NAS devices are specialized computers used for storage, file sharing, and media streaming. Users can install applications like Plex Media Server from the QNAP App Center. The QNAP Product Security Incident Response Team (PSIRT) confirmed that the vulnerabilities are specific to Plex Media Server and do not affect QNAP operating systems like QTS or QuTS hero directly.
Required User Actions
QNAP advises all users to update Plex Media Server to the latest version, currently 1.43.3.10861, available through the QNAP App Center. For users with a vulnerable Plex server exposed to the public web, QNAP recommends treating the NAS device and its contents as compromised. Updating alone will not remove existing malware. The recommended remediation includes checking for signs of compromise, performing a clean reinstall of the NAS operating system, and resetting both Plex and NAS credentials. Users who do not require remote Plex access should disable related features and stop forwarding port 32400.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-966524.3 MEDIUM CVE CVE-2026-966546.5 MEDIUM CVE CVE-2026-966554.3 MEDIUM CVE CVE-2026-966567.2 HIGHReporting from
QNAP has reported multiple compromises of its Network-Attached Storage (NAS) devices due to the Plex2Shell vulnerability chain affecting Plex Media Server. Users are advised to update Plex Media Server to version 1.43.3.10861 or later through the QNAP App Center to mitigate the risk. If compromised, a clean reinstall of the OS and credential resets are recommended.