What happened
- QNAP reported on 6 November 2026 that it had received reports from users whose Plex Media Server, installed on their NAS devices, appears to have been compromised through the Plex2Shell chain of flaws. BleepingComputer published the advisory that day.
- Plex2Shell brings together four vulnerabilities, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
- Researcher Zach Main discovered them and reported them to Plex on 27 July. Exploitation began shortly after the technical details became public, on 16 October.
- QNAP asks users to update Plex Media Server to the latest version in its App Center, currently 1.43.3.10861.
Why it matters
- A NAS holds backups and personal files, and many people install applications such as Plex on it to watch films and listen to music from the home network.
- According to QNAP, if the vulnerable Plex server is exposed to the public web, the device and all its content should be treated as compromised.
- Updating now does not clean what attackers have already installed: the advisory says so explicitly.
The number
Three days. That is the deadline the US cybersecurity body CISA gave federal departments to move to Plex 1.43.3.10861 or later, at top priority, when it added the four flaws to its catalogue of exploited vulnerabilities on 20 October 2026.
Context
QNAP makes clear that the flaws exist only in Plex Media Server. Its operating systems QTS, QuTS hero and others are not themselves affected: the risk comes from the application the user installed on top.
The company’s security incident response team confirmed that point, and it offers technical assistance to affected users. The security bulletin includes the signs of compromise to check, and the advisory’s recommendation is a clean reinstall on devices that show those signs.
One practical aspect repeats in incidents like this: the fix has existed for weeks, but many home and small-office devices do not update on their own. Third-party applications inside a NAS depend on someone updating them by hand, and devices left open to the internet so content can be watched away from home are the most exposed.
At Mamífero we follow flaws that are exploited in the wild. We reported that an oversized password opens no-password Linux accounts with OpenSSH and musl and that attackers used the cPGuard update to steal data. Also that PHP fixed two remote execution flaws stalled for two years and that data on more than 40,000 Homeland Security staff was published.
What’s next
- Users with Plex exposed to the internet should check the signs of compromise in QNAP’s bulletin.
- Those already affected will need to reinstall the device, because the update does not remove installed access.
- It is worth taking the Plex server off the public web if it is not essential.
Bottom line
The flaw is not in the NAS, but in what was installed on top of it. As long as devices with outdated applications stay open to the internet, this chain of flaws will keep opening doors.
Sources
- BleepingComputer, “QNAP says hackers breaching NAS devices in Plex2Shell attacks”, 6 November 2026, link.
- Cover image: Jemimus, CC BY 2.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
