Plex2Shell: Check Your NAS Update and Its Exposure History

If you have just updated Plex on a household NAS, one useful question remains: was the old server reachable from outside your home? New notices from QNAP and Synology make that history worth checking. Installing a fixed release closes the Plex2Shell vulnerabilities, but it cannot establish what happened while an older installation was exposed.

In its November 6 security notice, QNAP says some users reported Plex installations on their NAS devices that appeared to have been compromised. Its support team is assisting them. Synology’s November 8 advisory announces updated DSM packages for the same flaws. It does not report compromised Synology devices. Those are different kinds of evidence, even though both notices give owners a reason to check their software.

The version numbers that matter

Plex2Shell combines four vulnerabilities affecting Plex Media Server 1.43.2 and earlier: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, they can let an attacker run code without signing in, with the permissions of the Plex process. QNAP says its QTS and QuTS hero operating systems do not themselves contain these flaws.

The fix predates these NAS notices. Plex announced its security update on September 1. Its October 19 follow-up identifies 1.43.3.10861 or later as unaffected and reports widespread exploitation of unpatched, internet-facing servers.

For the vendor packages, check these versions:

• QNAP: update Plex through App Center, then confirm 1.43.3.10861 or later in Plex Web under Settings → General.
• Synology DSM 7.4 and 7.3: the advisory specifies 1.43.5.11079-720011079 or later.
• Synology DSM 7.2.2 and 7.2.1: it specifies 1.43.5.11079-700011079 or later.

Synology’s package recommendations are newer than the original Plex fix. Match the package to your DSM version rather than treating those numbers as competing answers. A NAS firmware update alone also leaves the separate Plex-version check unfinished.

Look back at exposure

For QNAP owners, the remediation FAQ draws a practical distinction. For this incident, QNAP says updating is sufficient if Plex was never internet-reachable, while still recommending exposure-reduction settings. If vulnerable Plex was reachable, treat the NAS as potentially compromised and follow the recovery guidance. The FAQ also calls for recovery precautions if the upgrade came only after the October 16 public proof-of-concept release. Investigate signs of compromise regardless of the exposure history.

Check the configuration you actually used: Plex Remote Access, router forwarding for port 32400, and automatic port opening through UPnP or myQNAPcloud. Today’s closed port cannot tell you whether the server was reachable last month. If someone else set it up, ask them about the old configuration as well as the current one.

Plex’s October exploitation update lists warning signs including unfamiliar processes, unexpected files in its Codecs folder and sustained CPU use when nothing is playing. It also recommends recovery when compromise cannot be ruled out. A quiet server is therefore a poor substitute for checking its exposure history.

Keep evidence before cleanup

QNAP asks owners seeking help confirming a compromise to preserve the Plex Logs folder before removing Plex. Its clean-reinstall procedure concerns Plex and its application data, including avoiding reuse of old Codecs contents. Follow the full instructions for inspection, signing out all Plex devices before changing the Plex password, and resetting NAS passwords and other stored service credentials. The FAQ does not prescribe wiping every NAS disk.

This is where the household stakes extend beyond whether movies still play. Plex says resources its service account could access should be treated as potentially exposed. Review which shares and stored credentials that includes before deciding recovery is finished.

Keep two records: the version now installed, and what you established about earlier exposure and any follow-up. Synology’s “Resolved” advisory status tells you a fix is available. Confidence in an individual NAS takes evidence about that particular device.

Sources

• QNAP: November 6 Plex2Shell security notice (notice text verified from QNAP’s indexed excerpt)
• QNAP: Plex2Shell checks and recovery FAQ
• Synology SA-26:17: affected DSM packages and fixed releases
• Plex: original security announcement and exploitation update