Taiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

Hackers are now using a public exploit chain called Plex2Shell to break into unpatched Plex Media Server systems and install cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit code went public on October 16, 2026. Plex2Shell links four flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, they let a remote user run code on a server without a password. The code runs with the same rights as the Plex service. Security researcher Zach Main found the bugs and reported them to Plex on July 27. Plex confirmed the report and paid a bounty on August 4. Hackers Exploit Plex2Shell Flaws Plex Media Server often listens on port 32400, and many people leave it open to the internet so they can stream from anywhere. That makes it an easy target for anyone scanning for it. The first flaw is a server-side request forgery bug in the /player/timeline endpoint. The server only checks that a token exists, not that it is valid, so even a fake token works. An attacker can then slip a full web address into the protocol field and trick Plex into sending a request to itself. That request appears to come from the machine itself, which Plex trusts more. It opens a plugin interface that normally needs no token for local traffic. A broken check in the plugin code lets the attacker call other plugin functions. The attacker then uses a TVDB plugin function and a web address that starts with 127.0.0.1 but points to a server the attacker controls. Plex sees the local prefix and adds the owner’s admin token to the request. The token goes straight to the attacker. With the admin token, the attacker changes a transcoder setting so Plex writes a malicious file into its codec folder. The file is hidden inside a video. The next time Plex transcodes a video, it loads that file and runs it. The researcher’s write-up and proof-of-concept code are public on GitHub. A researcher running a honeypot, a decoy server used to watch attacks, saw the first real exploitation on October 17. The attackers dropped an XMRig-based Monero miner and a Linux proxy tool called “myawesomeproxy.” The Hacker News reports that the miner pointed to a domain tied to the AISURU botnet. The attacks fetched payloads from 217.60.194[.]116. Cybersecurity News also covered the first exploitation reports . It noted that the evidence did not show how many real servers were hit. The attack is not limited to home servers. QNAP says some NAS users have been breached, and BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities list on October 20. Update to Plex Media Server 1.43.3.10861 or newer, and check the version the server actually reports. Updating will not remove a payload that is already installed. QNAP advises treating an exposed server as compromised, checking for signs of infection, doing a clean reinstall, and resetting credentials. Stop forwarding port 32400 if you do not need remote access. If you do need it, use a VPN. Also check the Plex process for strange child processes, unknown downloads, and high CPU use. Miners often show up first as a slow, hot server. For another example of how exposed services get turned into miners, see this Redis cryptojacking campaign . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners appeared first on Cyber Security News .

Derzeit nutzen Angreifer die Plex2Shell-Schwachstellen in Plex Media Server aus. Nun ist eine abgesicherte Version auch für Qnap NAS erschienen.

Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

 QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later.  Technical scope  Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation. Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again.  Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise.  Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure.  Secure reinstallation  For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.

Synology has released a security update for the Plex Media Server package in DSM to address the Plex2Shell vulnerabilities. Continue reading... - - - Synology Product Security Advisory: check the list Source: synology.com

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

QNAP says hackers are exploiting the Plex2Shell vulnerability chain against Plex Media Server applications on QNAP NAS devices.

台湾のストレージ・ネットワーク機器メーカーであるQNAPは、攻撃者が「Plex2Shell」を悪用し、QNAP製NAS上で稼働するPlex Media Serverに侵入していると警告しました。 Plex2Shellは、Plex Media Serverに存在する4件の脆弱性（CVE-2026-96652、CVE-2

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. [...]

QNAP says some NAS devices running vulnerable Plex Media Server builds appear compromised through Plex2Shell, with support assisting affected users.

QNAP reports suspected Plex2Shell compromises. Verified Plex versions, four CVEs, CISA records and an evidence-first NAS recovery checklist for Gulf and Egypt teams.