Attackers exploit four-flaw Plex chain to breach QNAP NAS devices
Patching Plex alone will not clear attacker payloads already installed, so exposed owners need a clean reinstall and new credentials.
QNAP has warned that attackers are exploiting a four-flaw chain in Plex Media Server, dubbed Plex2Shell, to compromise customers' network-attached storage devices. The company has received multiple reports of suspected compromises and is helping affected users. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were reported to Plex by researcher Zach Main on July 27, and exploitation began soon after full technical details were published on October 16. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20 and told federal agencies to move to Plex 1.43.3.10861 or later within three days. QNAP says only the Plex application is affected and not its operating systems, but notes that patching will not remove payloads already planted, so exposed servers should be treated as compromised, cleanly reinstalled and have credentials reset.
Why it matters
Owners of QNAP network storage that runs Plex Media Server now face active intrusions, not just a theoretical risk. QNAP says only the Plex application is affected and not its operating systems, so the exposure sits in one software package that many home and small-office users run on their storage. Because updating Plex does not remove payloads already planted, a server that was reachable during the attacks should be treated as compromised, rebuilt from a clean install and given new passwords. Federal agencies in the United States were given a three-day deadline to upgrade, a sign of how seriously the flaws are being taken.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.