QNAP says Plex Media Server 1.43.2 and earlier on its NAS boxes is under active attack through the Plex2Shell flaw chain, used to run crypto miners and proxy software. Install 1.43.3.10861 or later from App Center. If Plex was reachable from the internet, QNAP says updating is not enough: reinstall Plex clean and reset credentials.
If you run Plex Media Server on a QNAP NAS, open App Center today and confirm Plex is on version 1.43.3 (build 1.43.3.10861) or later. QNAP warned on November 6 that Plex 1.43.2 and earlier is being exploited through a flaw chain called Plex2Shell. If your Plex server was reachable from the internet while it ran an old build, updating closes the hole but does not remove anything an attacker already installed.
What QNAP and Plex confirmed
QNAP’s notice says its own operating systems, QTS and QuTS hero, are not affected. The risk sits in the Plex app that many owners install on top. QNAP quotes Plex as confirming the flaws “are being actively and widely exploited,” and says some QNAP users have reported Plex servers that appear compromised.
Plex shipped the fix on September 1 in Plex Media Server 1.43.3. On October 19 it updated its advisory with four CVEs and a warning: a public proof of concept went out on October 16, and since then it has seen widespread attacks on internet-facing servers that had not updated. Per Plex, compromised servers have been used to run cryptocurrency miners and proxy software that routes other people’s traffic through the victim’s internet connection.
The four bugs, as Plex describes them:
| CVE | What it does |
|---|---|
| CVE-2026-96652 | Unauthenticated server-side request forgery in the player timeline endpoint |
| CVE-2026-96654 | Access to internal agent functions over the loopback interface |
| CVE-2026-96655 | Leaks the server owner’s admin token |
| CVE-2026-96656 | Writes arbitrary files to the Codecs folder through transcoder preferences |
Each is limited on its own. Chained, they let an attacker with no login run code with the Plex process’s permissions, which on a NAS usually means access to every shared folder Plex can read.
Were you exposed?
QNAP’s check and remediation FAQ says to treat the NAS as potentially compromised if Plex ran 1.43.2 or earlier and any of these was true:
- Remote Access was on in Plex Web (Settings, then Remote Access).
- Your router forwarded port 32400.
- UPnP was on together with Plex Remote Access.
- Plex was published through myQNAPcloud auto router configuration or any other route.
If Plex was only ever reachable inside your home or office network, QNAP says the update is enough.
What to do if it was exposed
QNAP’s order, from its FAQ:
- Update. App Center, then My Apps, then Plex Media Server, then Update. Confirm 1.43.3 or later.
- Save the logs. Copy the Plex Logs folder (inside the PlexData shared folder) somewhere else if you want QNAP support to investigate.
- Reinstall clean. Remove Plex in App Center, delete everything left in the Codecs folder, check Preferences.xml for transcoder options you did not set, then reinstall 1.43.3 or later. Do not restore the old Codecs files.
- Look for signs. QNAP and Plex list processes named myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in Codecs, outbound connections to proxystream.st, and high CPU while nothing plays. QNAP’s Malware Remover may flag detection code MR2104. QNAP warns against deleting only the suspicious program, since other pieces may stay behind.
- Reset credentials. Sign out all devices from your Plex account, then change the Plex password. Change NAS admin and user passwords, turn on two-step verification, and rotate keys for backup jobs and cloud connections on the box.
- Close the door. Turn off Plex Remote Access if you don’t need it, remove the port 32400 forward, disable UPnP and drop any myQNAPcloud auto router rule for Plex. Use a VPN for remote viewing.
QNAP Technical Support is taking cases at service.qnap.com.
The media app is now the weak spot on a home office NAS
This is the second NAS campaign in a week, after C3RB3R ransomware hit unpatched Synology boxes. The difference matters for how you patch. Here the NAS operating system was fine, and the hole came in through a third-party app with its own update cycle and its own open port. Plex fixed the bugs about seven weeks before the attacks started, so the exposed servers were the ones nobody updated. If one box holds both your movie library and your work files or laptop backups, the Plex service account can reach both. Keep Plex off the open internet, turn on automatic app updates in App Center, and give the Plex user access only to the media folders it needs.