QNAP has told owners of its network storage devices to update Plex Media Server now, because attackers are actively exploiting a chain of four bugs known as Plex2Shell to take over the hardware.
The flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) affect Plex Media Server 1.43.2 and older. QNAP said in its advisory that Plex has confirmed they are being "actively and widely exploited." Each bug is relatively dangerous alone. Chained, they let an unauthenticated attacker run code remotely with the highest privileges, which means full control of the device and access to anything stored on it.
The timeline is longer than the advisory suggests. Plex released a fix in September, and a proof-of-concept exploit (working attack code) appeared a few weeks later. CISA added all four bugs to its Known Exploited Vulnerabilities catalog on October 20 and gave federal civilian agencies three days to patch or stop using Plex. Security companies have since reported attacks that mostly install proxy software and cryptocurrency miners.
The proxy software is the more plausible payload. A proxy network routes an attacker's traffic through ordinary home or office connections, which hides who is behind it and can support DDoS attacks (floods of traffic meant to knock services offline). Operators can sell that access, so hijacked storage boxes have a market. Miners are a poor fit, since most need powerful GPUs.
The fix is Plex Media Server 1.43.3 (build 1.43.3.10861), available through QNAP's App Center. The bugs are in Plex itself; QNAP's QTS and QuTS operating systems are not affected.
The harder instruction is for anyone whose NAS was reachable from the internet while running an older version. Plex said updating is not enough for those users. They should treat the device as compromised, then do a clean reinstall, a compromise check and a credential reset.
BitSight figures put internet-accessible QNAP devices in the tens of thousands. Many may not run Plex, so the number at risk is smaller, but the dividing line is simple: Plex installed, and a path in from the internet.