QNAP says hackers are breaking into its NAS drives through Plex

QNAP, the Taiwanese maker of network-attached storage, confirmed on Nov. 6 that attackers are breaking into some of its NAS drives through the Plex Media Server app installed on them. The company says it has received reports from owners whose Plex installations were compromised, and its technical support team is working with those users.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The weakness sits in the third-party media app, not in the storage operating system that QNAP writes. That distinction matters for the fix, because updating the NAS firmware alone does nothing, and a box that was reachable from the internet while running an old Plex build may need more than a patch.

Four Plex flaws chained into Plex2Shell

The attacks use a set of four bugs that Plex disclosed as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, affecting Plex Media Server 1.43.2 and earlier. QNAP’s security notice says each is limited on its own, but chained together they let an unauthenticated remote attacker run code with the privileges of the Plex process. The combination is called Plex2Shell.

Security researcher Zach Main found the chain and, in a technical write-up, scored the full sequence at 9.8 out of 10 for severity. It starts with a request-forgery bug in an endpoint that checks only whether a Plex token header exists, not whether it is valid. That lets an attacker make the server call itself, reach an internal plugin interface, and steal the owner’s admin token. From there a transcoder setting can write a malicious shared library to disk, and the transcoder loads it on the next video conversion.

Main reported the problems to Plex on July 27, and Plex acknowledged the report on Aug. 4 and paid a bounty. The write-up describes using language models to speed up each stage of the hunt while keeping the judgment calls human, and credits the Plex security team with a quick response.

For a home NAS owner the consequences are concrete. A Plex server is often the one service on the box that is deliberately opened to the internet so relatives can stream from outside the house, which puts the vulnerable code on the same machine that holds family photos, backups and personal video. The attackers’ reported payloads, a cryptocurrency miner and proxy software, burn the drive’s processor and bandwidth, and the same foothold would allow far worse access to whatever the NAS stores.

Exploitation timeline from Oct. 16 to the Nov. 6 notice

The gap between the patch and the warning is the uncomfortable part. Fixed Plex builds, version 1.43.3.10861 and later, were available from Aug. 4, but full technical details went public on Oct. 16, and BleepingComputer’s report on the federal warning says exploitation in the wild began on Oct. 17, with attackers first hitting honeypot servers to deploy a cryptocurrency miner.

The Cybersecurity and Infrastructure Security Agency added all four flaws to its Known Exploited Vulnerabilities catalog on Oct. 20, and told federal agencies to patch within days. QNAP’s own notice followed on Nov. 6, more than two weeks later. Plex has said compromised servers have also been used to run proxy software, a use that turns a home storage box into a relay for other people’s traffic.

BleepingComputer, which first reported that QNAP says its devices are being breached, quotes the company’s PSIRT as saying QTS, QuTS hero and other QNAP operating systems are not affected by the flaws.

Updating Plex versus cleaning an exposed NAS

QNAP’s guidance has two tiers. Every owner should open the App Center, go to My Apps, and update Plex Media Server to 1.43.3.10861 or later, then confirm the version number under Settings and General in Plex Web. QNAP says not to wait for a later release.

Owners whose Plex was reachable from the internet are told to assume the worst. Exposure includes Plex Remote Access, a forwarded port 32400, or ports opened automatically through UPnP. Updating does not remove payloads an attacker already installed, so the company’s check and remediation FAQ calls for a clean reinstall of QTS or QuTS hero, a search for indicators of compromise, and new credentials for both Plex and the NAS.

People who suspect a break-in should preserve the Plex Logs folder before removing the app and open a case with QNAP Technical Support. Those who do not need remote streaming can switch off Plex Remote Access and stop forwarding port 32400, and anyone who does need it is advised to connect through a VPN.

QNAP also points to its technical support portal for owners who want logs examined. The company’s notice is explicit that the flaws exist only in Plex Media Server and that other QNAP software is not part of the problem, which means owners running a different media app are not covered by this warning, though the company still advises keeping QTS or QuTS hero and every installed app current.

The unanswered question is scale. QNAP has described reports from users but has not said how many devices were compromised, and no source read for this article gives a count of exposed Plex servers.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.