What happened
Plex2Shell is a chain of four vulnerabilities in Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Chained together, they let an unauthenticated remote attacker run code with the privileges of the Plex process. The attackers don't need a password, only a reachable server.
The timeline matters, because this wasn't a zero-day:
- July 27: Security researcher Zach Main reported the flaws to Plex. BleepingComputer gives that date, and its report says exploitation began shortly after full technical details went public on October 16.
- Early August to September 1: Plex shipped the fixed server, and its security notice told users on 1.43.2 and earlier to update. A secondary write-up dates build 1.43.3.10861 to August 3.
- October 16: The public proof of concept appeared, and attacks followed.
- October 20: BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities catalog. It told federal agencies to move to 1.43.3.10861 or later within three days.
So a patch existed for roughly ten weeks before the exploit went public. NAS owners often run apps that update on a delay and that nobody checks. That is the kind of gap attackers look for.
Who is affected
The flaws affect Plex Media Server 1.43.2 and earlier. The fixed threshold is 1.43.3.10861 or later.
QNAP's own operating systems aren't the problem. QNAP's PSIRT confirmed the vulnerabilities exist only in Plex Media Server, and that QTS, QuTS hero and other QNAP operating systems are not themselves affected. A NAS without Plex installed is not in scope for this issue.
This is not a claim that every QNAP NAS was hit. QNAP's warning applies to a vulnerable Plex server that was reachable from the internet. QNAP says users should treat their NAS devices and personal content as compromised if they're running a vulnerable Plex server exposed on the public web.
Exposure can happen in more ways than deliberately opening a port. Based on QNAP's guidance as relayed in the research, any of these would count:
- Plex Remote Access enabled
- A router forwarding TCP port 32400
- UPnP combined with Remote Access, which can open the port automatically
- Exposure through myQNAPcloud router configuration or another method
Patching doesn't clean a breached NAS
This is the key point. QNAP warned that updating now will not remove any payloads the attackers have already installed. Secondary coverage agrees. The update blocks the vulnerability chain, but does not remove any malware that may already be installed.
Plex has said the payloads seen on compromised servers include cryptocurrency miners and proxy software. A miner is irritating. A proxy that routes other people's traffic through your home or office connection is a bigger problem.
Step by step
1. Update Plex
Open App Center, go to My Apps, find Plex Media Server and update it. Confirm the version is 1.43.3.10861 or later. CyberInsider describes the same route: App Center > My Apps, then update to 1.43.3 or later.
If the update doesn't show up, refresh App Center and check that the NAS can reach the internet. Plex has warned that NAS app stores can lag behind. In that case a manual package install is an option, but use the right package for your CPU architecture.
2. Decide whether you were exposed
If you ran 1.43.2 or earlier while the server was internet-reachable, assume compromise. If you never forwarded a port, never enabled Remote Access and never used UPnP, your risk is much lower. Still check, because UPnP does things quietly.
3. Preserve logs before cleaning up
If you want QNAP support to investigate, copy the Plex Logs folder before uninstalling. QNAP's technical support portal accepts submissions. Include the Plex version, whether the server was internet-accessible, and any indicators you found.
4. Look for indicators
QNAP lists these signs, and none is proof on its own:
- Unfamiliar processes started by Plex, especially myawesomeproxy, mylovelyminer or x12345
- Unknown .so or .dll files in the Plex Codecs folder
- Outbound connections to proxystream.st
- Sustained high CPU use when nothing is playing
- A Malware Remover detection such as MR2104
5. Reinstall cleanly
BleepingComputer's report describes QNAP's recommendation as a clean reinstall of the OS (QTS or QuTS hero). It also recommends checking the signs of compromise and then resetting credentials. For Plex itself:
- Remove Plex from App Center.
- Check the PlexData shared folder for a leftover "Plex Media Server" folder, and don't reuse it as-is.
- At a minimum, delete everything in the Codecs folder and inspect Preferences.xml for transcoder options you didn't set.
- Reinstall 1.43.3 or later and let Plex download the components it needs. Don't restore the old Codecs folder.
Deleting one suspicious file may leave persistence mechanisms behind. That is why the vendor leans toward a full rebuild rather than a spot clean.
6. Reset credentials in the right order
Sign out all devices from the Plex account and change its password. The Plex administrator token may have been exposed, so a password change alone isn't enough.
Then treat everything the Plex service could reach as exposed:
- Change NAS account passwords and rotate credentials stored on the device, including those used for backups or cloud connections.
- Check mounted shares and any saved keys for other services.
- Turn on two-step verification wherever it's offered.
Reducing future exposure
- If you don't need remote access, turn Plex Remote Access off and remove the port 32400 forwarding rule from your router.
- Disable UPnP on the router, and remove any myQNAPcloud automatic router configuration for Plex.
- If you need remote access, QNAP recommends connecting through a VPN.
- Keep QTS or QuTS hero and your apps current. QNAP also suggests scheduled Malware Remover scans and QuFirewall.
- If your NAS no longer receives software updates, reconsider how much you trust it with exposed services.
These are vendor recommendations. A VPN reduces the attack surface, but no single measure guarantees safety.
Why Windows and IT readers should care
A NAS is often the most trusted box on a small network. It holds PC backups, shared folders and saved credentials for cloud sync. A compromised Plex process inherits whatever that account can reach. That is why QNAP's advice covers backup and cloud credentials, not just Plex logins.
For admins, the lessons are familiar. Third-party apps on appliances need patch tracking. "Latest in the app store" can lag the real fixed version. And CISA's KEV listing is a signal for home and small-office devices too, even though its deadlines bind only federal agencies.
What we don't know
- QNAP hasn't quantified the compromises.
- No named threat actor has been attributed.
- Different sources date the fixed build slightly differently, between August 3 and 4. All agree the fixed threshold is 1.43.3.10861.
- Some coverage cites later Plex builds, so confirm in the Plex or QNAP interface that you are at or above the fixed version.
Patch first, then assume nothing is clean if the server was exposed. Rebuild, rotate credentials and close port 32400.