[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-qnap-warns-plex2shell-attacks-are-hitting-older-plex-servers":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12641,"qnap-warns-plex2shell-attacks-are-hitting-older-plex-servers","QNAP Warns Plex2Shell Attacks Are Hitting Older Plex Servers","QNAP says attackers are chaining four Plex Media Server bugs to take over NAS devices, and updating will not clean up any that were already exposed.","QNAP has told owners of its network storage devices to update Plex Media Server now, because attackers are actively exploiting a chain of four bugs known as Plex2Shell to take over the hardware.\n\nThe flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) affect Plex Media Server 1.43.2 and older. QNAP said in its advisory that Plex has confirmed they are being \"actively and widely exploited.\" Each bug is relatively dangerous alone. Chained, they let an unauthenticated attacker run code remotely with the highest privileges, which means full control of the device and access to anything stored on it.\n\nThe timeline is longer than the advisory suggests. Plex released a fix in September, and a proof-of-concept exploit (working attack code) appeared a few weeks later. CISA added all four bugs to its Known Exploited Vulnerabilities catalog on October 20 and gave federal civilian agencies three days to patch or stop using Plex. Security companies have since reported attacks that mostly install proxy software and cryptocurrency miners.\n\nThe proxy software is the more plausible payload. A proxy network routes an attacker's traffic through ordinary home or office connections, which hides who is behind it and can support DDoS attacks (floods of traffic meant to knock services offline). Operators can sell that access, so hijacked storage boxes have a market. Miners are a poor fit, since most need powerful GPUs.\n\nThe fix is Plex Media Server 1.43.3 (build 1.43.3.10861), available through QNAP's App Center. The bugs are in Plex itself; QNAP's QTS and QuTS operating systems are not affected.\n\nThe harder instruction is for anyone whose NAS was reachable from the internet while running an older version. Plex said updating is not enough for those users. They should treat the device as compromised, then do a clean reinstall, a compromise check and a credential reset.\n\nBitSight figures put internet-accessible QNAP devices in the tens of thousands. Many may not run Plex, so the number at risk is smaller, but the dividing line is simple: Plex installed, and a path in from the internet.","[\"plex2shell\",\"qnap\",\"nas\",\"vulnerability\"]","2026-11-09T16:34:22.000Z","2026-11-09T17:54:42.564Z","2026-11-09T17:54:42.836Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the leftover editing-note phrasing ('which the source says can earn operators a hefty sum') and state the claim directly or attribute it properly. Also soften 'Each is dangerous alone' to match the source's 'relatively dangerous', and tighten the timeline so the September fix, the 'few weeks later' proof-of-concept and the October 20 CISA date read clearly (the source's 'earlier in November' disclosure conflicts with them, so don't import it).","resolved","security",[32,33,34,35],"plex2shell","qnap","nas","vulnerability",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fqnap-says-more-nas-devices-hit-in-worrying-plex2shell-malware-attacks",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",641,"2026-11-12T10:26:13.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]