---
title: QNAP: some NAS boxes running Plex Media Server look compromised via Plex2Shell — patch to 1.43.3.10861+, treat internet-exposed installs as dirty | ctxsec
url: https://ctxsec.com/items/qnap-plex2shell-nas-compromises-security-notice-nov-6
description: "QNAP published a Nov 6 security notice after receiving user reports that Plex Media Server on QNAP NAS devices appears compromised through the Plex2Shell chain (CVE-2026-96652/96654/96655/96656 in Plex 1.43.2 and earlier). QNAP PSIRT says the bugs live only in Plex, not in QTS or QuTS hero. Fixed Plex 1.43.3.10861+ is in the App Center. If a vulnerable Plex instance was reachable from the internet (Remote Access, port 32400 forward, UPnP/auto-config), updating alone will not remove attacker payloads \u2014 QNAP tells owners to follow its FAQ for clean reinstall, IOC checks, and credential resets, and to prefer VPN over open remote access."
status: "official (QNAP security notice, Nov 6); Plex confirms active widespread exploitation; QTS/QuTS hero themselves not vulnerable"
published: 2026-11-06
---

> QNAP published a Nov 6 security notice after receiving user reports that Plex Media Server on QNAP NAS devices appears compromised through the Plex2Shell chain (CVE-2026-96652/96654/96655/96656 in Plex 1.43.2 and earlier). QNAP PSIRT says the bugs live only in Plex, not in QTS or QuTS hero. Fixed Plex 1.43.3.10861+ is in the App Center. If a vulnerable Plex instance was reachable from the internet (Remote Access, port 32400 forward, UPnP/auto-config), updating alone will not remove attacker payloads — QNAP tells owners to follow its FAQ for clean reinstall, IOC checks, and credential resets, and to prefer VPN over open remote access.

[← Cybersecurity News](/news) · [markdown](/items/qnap-plex2shell-nas-compromises-security-notice-nov-6.md)

official (QNAP security notice, Nov 6); Plex confirms active widespread exploitation; QTS/QuTS hero themselves not vulnerable

2026-11-06

### QNAP: some NAS boxes running Plex Media Server look compromised via Plex2Shell — patch to 1.43.3.10861+, treat internet-exposed installs as dirty

- **Update path:** App Center → My Apps → Plex Media Server ≥ 1.43.3, then confirm Settings → General shows 1.43.3.10861 or later.
- **If previously exposed:** preserve Plex Logs before removal if you want QNAP support help; clean-reinstall QTS/QuTS hero per FAQ; reset Plex and NAS credentials; do not restore an old Codecs folder.
- **Exposure cut:** disable Plex Remote Access and stop forwarding 32400 unless you front it with a VPN.
- Plex2Shell was already on CISA KEV (Oct 20); this is the NAS-vendor confirmation that compromises are landing on QNAP installs specifically.

Sources: [QNAP Security Notice: Plex2Shell — update to 1.43.3.10861 or later (Nov 6)](https://www.qnap.com/en/security-news/2026/qnap-security-notice-plex-media-server-vulnerabilities-plex2shell-update-to-1-43-3-10861-or-later-immediately) · [BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks](https://www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/)