Updated:07:08 PM CET Nov,06
(new)
(c) 1998-2026 Gameguru Mania
Privacy Policy statement
|
QNAP Warns: Hackers Breaching NAS Boxes via Plex2Shell Attacks - tech|
| (hx) 06:55 PM CET - Nov,06 2026 | QNAP says hackers are breaking into customer NAS devices by exploiting the Plex2Shell vulnerability chain in Plex Media Server.
The company confirmed it has received multiple reports of suspected compromises and is assisting affected users. Plex2Shell is a chain of four flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656) that let unauthenticated attackers remotely run code on internet-exposed Plex servers running version 1.43.2 or earlier.
CISA added all four to its Known Exploited Vulnerabilities catalog on October 20 after attacks began shortly after public details appeared on October 16. Attackers have used compromised servers to install cryptocurrency miners and proxy software.
QNAP stresses the bugs exist only in the Plex app; QTS and QuTS hero are not affected. Users with an exposed vulnerable Plex server should treat the NAS and its data as potentially compromised.
Updating to Plex Media Server 1.43.3.10861 via the App Center is required, but a full clean OS reinstall, credential reset, and compromise checks are recommended if the device was internet-facing.
|
|
last 10 comments: All comments
|
|
Add your comment (free registration required)