QNAP says attackers are taking over its home and office storage drives through four chained Plex flaws, and updating alone will not remove them.
QNAP, a maker of network storage drives, says hackers are breaking into some of its customers' devices through Plex Media Server, a popular app for streaming movies and music. The attack is called Plex2Shell. QNAP warns that installing the fix now will not kick out anyone who is already inside.
Plex2Shell is a chain of four flaws in Plex Media Server. Attackers link them together, so each flaw helps open the door for the next. Researcher Zach Main reported the flaws to Plex on July 27. Attacks began shortly after full technical details went public on October 16.
On October 20, 2026, the US cybersecurity agency CISA added all four flaws to its list of vulnerabilities being used in real attacks. It told federal agencies to upgrade to Plex 1.43.3.10861 or later within three days. QNAP now says some users report their Plex servers were compromised, and its support team is helping them.
A network storage drive, or NAS, is a small computer with built-in disks. Many people use one to back up computers and keep family photos and media. Plex is an add-on app that can be installed from the QNAP App Center.
QNAP's advice is blunt. If you run a vulnerable Plex server that is reachable from the public internet, treat the drive and everything on it as compromised. That means your files could be exposed, and so could the passwords tied to Plex and the drive.
QNAP says the flaws exist only in Plex Media Server. Its own operating systems, QTS and QuTS hero, are not affected. If you own a QNAP drive but never installed Plex, this particular attack does not apply to you. If you do run Plex, update anyway, even if you think your drive is not exposed.
The alert box above lists the steps in order. In short: update Plex, check for signs of a break-in, clean up if you find any, and close off remote access you do not need. QNAP has published a detailed step-by-step guide for this. It will also look over logs from suspected break-ins if you send them through its technical support portal.
The update fixes the hole but does not remove anything attackers already planted. That is why the check for signs of compromise matters, and why QNAP recommends a clean reinstall of the drive's operating system if the signs are there. Watch for new QNAP guidance, since the company says it is still receiving reports.
If your QNAP drive runs Plex, update it now, check it for signs of a break-in, and turn off remote access you do not need.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
