QNAP NAS Plex2Shell Warning: Users Report Hijacked Plex Servers, Patch to 1.43.3.10861

QNAP says "some users" have reported that Plex Media Server on their NAS appears to have been compromised through Plex2Shell, the chain of four Plex flaws behind October's wave of hijacked Plex servers. The Taiwanese vendor's notice is dated 6 November and gives no count of affected devices.

The flaws sit in the third-party app, not the NAS firmware: "QTS, QuTS hero, and other QNAP operating systems are not themselves affected". Plex said on 19 October that hijacked machines had been used "to run cryptocurrency miners and proxy software". CISA has listed all four CVEs, CVE-2026-96652, -96654, -96655 and -96656, in its Known Exploited Vulnerabilities catalogue since 20 October.

Why a patched NAS may still be compromised

Updating Plex closes the hole but doesn't remove anything already planted. QNAP's notice says: "If Plex was reachable from the Internet, treat the NAS as potentially compromised." In QNAP's definition that covers Remote Access switched on, port 32400 forwarded, or the port opened by UPnP.

Signs to look for

QNAP's check and remediation FAQ lists processes launched by Plex with names such as myawesomeproxy, mylovelyminer or x12345, unfamiliar .so or .dll files in the Codecs folder, outbound traffic to proxystream.st and high CPU while nothing is playing. Its Malware Remover flags the infection as MR2104.

What owners should do

• In App Center, under My Apps, update Plex Media Server, then confirm in Plex Web (Settings, General) that the build is 1.43.3.10861 or later. Plex warns that NAS package stores can lag and offers a manual install.
• If nobody needs to watch remotely, QNAP says to turn off Plex Remote Access and stop forwarding port 32400; remote use should go over a VPN.
• On a suspected compromise, copy the Plex Logs folder elsewhere before removing the app, then reinstall cleanly without restoring the old Codecs folder.
• Sign out every device in Plex and change the Plex password, then change NAS admin and user passwords, turn on two-step verification and rotate keys used by backup and cloud jobs.