QNAP warns Plex2Shell chain is breaching exposed NAS devices
November 9: Security Affairs says Zach Main published details and proof of concept on October 16, Plex shipped fixes in September, and federal agencies had an October 23 KEV deadline.
Attackers are exploiting four known Plex Media Server flaws on exposed systems, including some QNAP NAS devices; update to 1.43.3.10861.
QNAP says it received reports of suspected compromises of Plex Media Server on its NAS devices through the Plex2Shell chain. The four unauthenticated flaws, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can run code as the Plex service on internet-facing servers, often via port 32400. QTS and QuTS hero are not affected. Plex fixed the bugs in 1.43.3.10861 or later; updating does not remove an installed payload. CISA added all four to the KEV catalog on October 20 after public exploit code and observed attacks.
- Fixed in Plex Media Server 1.43.3.10861 or later
- Chain needs no valid credentials when conditions are met
- Honeypot saw an XMRig Monero miner and Linux proxy
- Payloads were fetched from 217.60.194[.]116, according to Cyber Security News
- Zach Main reported the bugs July 27; Plex paid a bounty August 4
- Federal agencies were told to address the KEV entries by October 23
Timeline
dated events in the reporting · oldest first- Jul 27, 2026Zach Main reported the Plex Media Server bugs · Cyber Security News
- Aug 4, 2026Plex paid a bounty for the reported bugs · Cyber Security News
- Oct 16, 2026Zach Main published details and proof-of-concept code · Security Affairs
- Oct 17, 2026Honeypot saw exploitation deploying a miner and proxy · Cyber Security News
- Oct 20, 2026CISA added all four flaws to the KEV catalog · Cyber Security News
- Nov 6, 2026QNAP warned of suspected NAS compromises via Plex2Shell · BleepingComputer
What each outlet adds
beyond the shared facts- BleepingComputerQNAP guidance to disable port 32400 or use a VPN
- Cyber Security NewsOctober 17 honeypot, miner and proxy, and payload host
- SecurityWeekAdvises rotating Plex and NAS passwords after compromise
- Security AffairsOctober 16 PoC date and October 23 federal KEV deadline
- Malware
- XMRigmyawesomeproxyAISURU
- Victims
- QNAP NAS users
Coverage
oldest first · one row per article · UTC- · 2d ago
BleepingComputerFirst report
QNAP NAS devices breached in Plex2Shell attacks
QNAP advises users to update Plex Media Server to 1.43.3.10861 after suspected compromises via a chain of four vulnerabilities.
- · 5h ago
Cyber Security News
Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
- · 3h ago
SecurityWeek
Plex2Shell chain exploited against QNAP NAS users
Four vulnerabilities in Plex Media Server were chained for remote code execution on exposed devices.
- · 1h ago
Security Affairs
QNAP says Plex2Shell flaws are used to compromise NAS devices
Users should move Plex Media Server to 1.43.3.10861 or later; exposed 1.43.2 installs may need a clean reinstall.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96656+3 related CVEs | Admin-Triggered Arbitrary File Write & RCE in Plex Media Server | 8.6 group max | 2% | KEV | KEV |