QNAP says hackers breaching NAS devices in Plex2Shell attacks

QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain.

The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices.

"QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users,” the company says in an advisory today.

Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.

Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16.