QNAP Plex2Shell: update, then check

If you run Plex Media Server on a QNAP NAS at home, this is the follow-up you needed after the October patch scramble. On November 6, 2026, QNAP published a security notice saying some users’ Plex installs appear compromised through Plex2Shell, and that QNAP support is helping those owners. The bugs still live in Plex, not in QTS or QuTS hero themselves. The fixed App Center package is Plex Media Server 1.43.3.10861 or later.

We already covered the general home-lab response in Plex2Shell: update your home Plex Media Server today. This page is narrower: QNAP’s November 6 notice, the App Center path, and the “update alone is not enough” path when Remote Access or port 32400 left Plex on the public internet.

What QNAP said on November 6

From QNAP’s security notice and its matching Plex2Shell FAQ for QNAP NAS users (last modified 2026-11-06):

• Plex2Shell is four bugs in Plex Media Server 1.43.2 and earlier: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656
• Chained together, they let an unauthenticated remote attacker run code as the Plex Media Server process
• Plex says a public proof of concept appeared on October 16, and internet-facing servers that were not updated saw widespread attacks
• Compromised servers have been used for cryptocurrency miners and proxy software
• QNAP has received reports that Plex on some customer NAS units appears compromised
• QNAP says it has not seen data loss in the cases it is assisting
• QTS, QuTS hero, and other QNAP operating systems are not themselves affected
• The fixed release in App Center is 1.43.3 (1.43.3.10861 and later)

SecurityWeek’s November coverage and BleepingComputer’s report match that framing: update now, and treat previously internet-reachable installs as possibly dirty.

This is a different story from the current Synology C3RB3R ransomware wave. Synology is about outdated DSM and ransomware. QNAP’s notice is about Plex on the NAS.

Check whether you are affected

Only a QNAP NAS with Plex Media Server 1.43.2 or earlier installed is in scope. No Plex package means no Plex2Shell action on the NAS itself.

1. Open App Center > My Apps.
2. Find Plex Media Server.
3. Read the version. You want 1.43.3 (build 1.43.3.10861 or later).
4. Also open Plex Web > Settings > General and read the server version there. App Center and Plex Web should agree after a clean update.

If App Center still shows an older package, refresh App Center and make sure the NAS can reach the internet. Do not leave an old package exposed “until later releases land.” QNAP says later Plex builds will arrive after verification, but the instruction is to update to 1.43.3 now.

Update path on a QNAP NAS

1. Go to App Center > My Apps > Plex Media Server > Update.
2. Confirm the listed version is 1.43.3 or later.
3. Open Plex Web and confirm Settings > General shows 1.43.3.10861 or newer.
4. If you do not need remote streaming, turn Remote Access off under Settings > Remote Access, and remove any router forward for port 32400.

Updating the phone or TV Plex app is not the same job. Clients stream. The server on the NAS is what attackers hit.

For broader NAS hygiene after you finish Plex, our home NAS patching checklist is still worth a pass.

When updating alone is not enough

QNAP’s FAQ is blunt: if Plex on your NAS was reachable from the internet while running 1.43.2 or earlier, updating closes the entry point but does not remove anything an attacker may already have installed. Treat the NAS as potentially compromised.

Count yourself in that group if any of these were true before you patched (or if you only patched after the October 16 proof of concept went public):

• Remote Access was enabled in Plex
• Your router forwards port 32400
• UPnP or router auto-configuration opened the port for Plex
• Plex was exposed through myQNAPcloud auto router configuration or any similar path

Then follow QNAP’s cleanup order, summarized here:

1. Optionally copy the Plex Logs folder (under “Plex Media Server” in the PlexData share) elsewhere if you want support help later.
2. In App Center, Remove Plex Media Server.
3. In File Station, do not casually reuse a leftover Plex Media Server folder inside PlexData. At minimum empty the Codecs folder and review Preferences.xml for transcoder options you did not set.
4. Reinstall 1.43.3 or later from App Center.
5. Do not restore the old Codecs folder. Let Plex download what it needs.
6. Look for QNAP’s named compromise signs: unknown processes started by Plex (names such as myawesomeproxy, mylovelyminer, or x12345), unfamiliar .so or .dll files in Codecs, outbound connections to proxystream.st, or sustained high CPU while nothing is playing.
7. Reset your Plex password and your NAS admin credentials. Sign out of Plex devices from the account side when you can.

If you only ever watched at home on the LAN and never opened Remote Access or port 32400, QNAP says the update itself is enough, and still recommends the exposure-reduction settings above.

Do this / don’t do that

Do

• Update Plex in App Center to 1.43.3.10861+, then confirm in Plex Web.
• Rebuild and rotate credentials if the server was internet-reachable on an older build.
• Turn off Remote Access and port 32400 forwarding unless you truly need them.
• Keep QTS / QuTS hero and other apps current while you are in App Center.

Don’t

• Do not assume “the NAS OS is fine” means Plex is fine. QNAP is clear the OS is not the buggy package.
• Do not stop at a phone-app update.
• Do not reuse a Codecs folder you no longer trust after a suspected compromise.
• Do not confuse this with the Synology ransomware campaign. Different vendor, different path.

Bottom line

QNAP’s November 6, 2026 notice says some home NAS units running Plex look compromised through Plex2Shell, and the fix package in App Center is Plex Media Server 1.43.3.10861 or later (QNAP security notice, QNAP FAQ). On your own QNAP: update Plex, verify the version, and if Remote Access or port 32400 left an old build on the internet, clean-reinstall Plex and reset credentials. Watching movies at home should not mean hosting someone else’s miner.

Image: Official QNAP brand sharing art from qnap.com.