QNAP Says Hackers Are Breaking Into NAS Devices

QNAP has confirmed that hackers are breaking into its customers’ NAS devices through a set of flaws in Plex Media Server known as Plex2Shell. The storage vendor has received multiple reports of suspected compromises and is urging all users to update the app without delay.

The attacks hit a familiar target in an unfamiliar way. This time the weakness is not in QNAP’s own software. QNAP’s Product Security Incident Response Team has confirmed the flaws exist only in Plex Media Server, the third-party app that many owners install to stream films, music and television programmes from their NAS. The QTS and QuTS hero operating systems are not themselves affected.

“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users,” the company said in its advisory.

What Plex2Shell does

Plex2Shell is a chain of four vulnerabilities tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Each flaw looks minor on paper. Strung together, they allow an attacker to run commands on a server without a valid username or password.

Security researcher Zach Main reported the flaws to Plex on 27 July. Plex shipped the fix in build 1.43.3.10861 in early August and urged all server owners to update in September. The danger arrived when the full technical details and a working proof of concept went public on 16 October. A honeypot set up by researchers recorded live attacks the very next morning.

Threat researchers have linked the intrusions to two payloads: an XMRig-based cryptocurrency miner and a Linux reverse proxy backdoor. The mining software quietly burns the device’s processor to earn digital coins for the attacker. The proxy routes other people’s internet traffic through the victim’s home connection, which can slow the network and tie strangers’ activity to the owner’s broadband account.

The US Cybersecurity and Infrastructure Security Agency (CISA) added all four flaws to its Known Exploited Vulnerabilities catalogue on 20 October. The agency set federal agencies a three-day deadline for two of the flaws and 3 November for the rest. Plex has confirmed the flaws are being actively and widely exploited.

How to check and update your QNAP NAS

Any NAS running Plex Media Server 1.43.2 or earlier is at risk if the server can be reached from the internet. Owners can check their version in Plex Web under server settings, then compare it against the patched build, 1.43.3.10861.

The fastest route for QNAP users is the QNAP App Center, which now carries the fixed version. Anyone running an older copy should update immediately, but updating alone is not enough. QNAP warns that installing the patch will not remove payloads an attacker may have already placed on the device.

Users whose vulnerable server was exposed to the public internet should treat the NAS and everything stored on it as compromised. QNAP recommends reviewing the signs of compromise listed in its security bulletin, performing a clean reinstall of QTS or QuTS hero, and then resetting all Plex and NAS passwords.

Owners who do not need remote access to Plex should switch off remote access and stop forwarding port 32400 on their router. Those who do need to reach their media library from outside the home should connect through a VPN instead. QNAP has published a step-by-step remediation guide and will examine logs from suspected breaches submitted through its technical support portal.

Devices without Plex installed need no action at all.

A familiar warning for NAS owners

QNAP owners have heard warnings like this before. The Qlocker and DeadBolt ransomware campaigns swept through thousands of internet-exposed QNAP devices in 2021 and 2022, encrypting owners’ files and demanding payment. Those attacks abused weaknesses in reaching the devices themselves. Plex2Shell arrives through a door many owners opened deliberately, the remote access feature that lets them watch their own media library away from home.

The lesson from both episodes is the same. A NAS is a small computer that runs around the clock with valuable personal files inside it, and anything facing the internet will eventually be found by scanners. A patched operating system offered no protection here because the hole sat inside a popular app. Updating the apps inside the App Center, not just the system itself, is now the habit that matters.