Hacked QNAP NAS via Plex? Updating isn't enough to clean it up

The CPU is running at full tilt even though no movie is playing. That's one of the signs Plex tells users to watch for on their media servers. Since November 6, owners of QNAP NAS devices, the network-attached storage boxes found in many homes and SMEs, have one more reason to take a close look.

In an advisory published that day, the Taiwanese vendor says it has received reports from users whose Plex Media Server software, installed on their NAS, "appears to have been compromised." The cause: Plex2Shell, a chain of four vulnerabilities that Plex says are being exploited "actively and widely." Versions 1.43.2 and earlier are vulnerable. The patched version, 1.43.3.10861, is available in QNAP's App Center. QNAP's own operating systems, QTS and QuTS hero, are not affected in themselves. But the vendor warns that the update does not erase anything an attacker may already have installed.

Four flaws that are harmless alone but dangerous when chained

The story begins last summer. According to BleepingComputer, researcher Zach Main reported the flaws to Plex on July 27. The vendor released a patched version on September 1^st without detailing the problems. On October 16, the technical details became public, along with proof-of-concept code, and attacks quickly followed. Plex updated its advisory on October 19. The next day, the US cybersecurity agency CISA added the four flaws to its catalog of exploited vulnerabilities. We covered this turning point in our October 21 article.

Taken one by one, these flaws pose a limited risk, QNAP stresses. The first (CVE-2026-96652) lets anyone, without an account, make the server send requests. The second (CVE-2026-96654) gives access to internal functions normally reserved for the machine itself. The third (CVE-2026-96655) hands over the owner's administration token. The last (CVE-2026-96656) allows a file to be written to the codecs folder through the transcoding settings. Chained together, they let a remote attacker with no credentials run their own code with the rights of the Plex process. According to Plex, quoted by QNAP, compromised servers have been used to run cryptocurrency miners and proxy software.

Why QNAP advises starting from scratch

The criterion is simple. If Plex was reachable from the Internet with version 1.43.2 or earlier, QNAP asks you to treat the NAS as potentially compromised. That is the case if Plex's remote access was enabled, if port 32400 was forwarded to the NAS, or if the router opened it by itself (UPnP). The vendor then recommends cleanly reinstalling Plex Media Server, looking for indicators of compromise, and changing the Plex and NAS credentials. To get help from its support team, you must keep Plex's logs folder ("Plex Logs") before uninstalling the software.

What to do if Plex runs on your NAS or PC

Plex's advice applies to all installations, not just QNAP NAS devices:

• Check the version in Plex Web (Settings, then General) and move to 1.43.3.10861 or later. On QNAP, the update is done in App Center, under My Apps.
• Look for the traces flagged by Plex: processes named myawesomeproxy, mylovelyminer or x12345, unknown .so or .dll files in the Codecs folder, outbound connections to proxystream.st, unknown transcoding options in Preferences.xml, or a heavily loaded CPU with nothing playing.
• If in doubt, start over with a clean installation, empty the Codecs folder, sign out all devices from your Plex account and change its password. Plex advises treating everything the Plex service account had access to as potentially exposed, from shares to credentials.
• Close the door: disable remote access if you don't need it, don't forward port 32400 and, as QNAP advises, use a VPN to reach your files while traveling.

One big unknown remains: the number of affected servers. Neither Plex nor QNAP gives a figure. Owners of other NAS brands that run Plex have every reason to perform the same checks.