On November 6, 2026, QNAP published guidance following reports of suspected Plex Media Server compromises on NAS devices. Plex2Shell combines four flaws to allow code execution without first signing in. A small business NAS may hold backups and access to other services, so installing the fix does not settle every recovery question.
A third-party application provides entry
The chain combines CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. QNAP explicitly distinguishes Plex from QTS and QuTS hero. BleepingComputer places the new reports in the disclosure timeline; SecQuill explains why a NAS operating system can be unaffected while an installed application remains vulnerable. This is not evidence that every QNAP NAS has been breached.
Reconstruct Plex exposure
Check the version and the history of Plex Remote Access, port 32400 forwarding and automatic router configuration. A local-only NAS presents a different situation from an internet-facing installation running Plex 1.43.2 or earlier. Record what was enabled during that period, even if the configuration has since changed.
Patch and follow the official procedure
Install at least Plex 1.43.3.10861 through App Center. For a previously exposed installation, follow QNAP’s current procedure to preserve useful logs, cleanly reinstall Plex and examine indicators of compromise. Do not restore the previous contents of the Codecs folder. Plex will download the components it needs. Get assistance before an operation that could delete data or evidence. Guidance may develop as investigations continue.
Reset access beyond Plex
For a potentially compromised NAS, assess shared folders available to the Plex process and secrets held by backup jobs or cloud connections. QNAP calls for signing out Plex devices before changing the password, then resetting NAS access and credentials stored by other services. Use a healthy device to prepare a checklist so an old backup account is not overlooked.
The link with Soclyde
That access list can be organised in Soclyde’s encrypted vault, kept on the user’s devices. Separate passwords for the NAS, Plex and each connected service avoid reusing one secret. Soclyde does not clean the NAS or terminate its sessions: those steps still take place in Plex, QNAP and connected services.
Takeaway
Track three separate outcomes: Plex is patched, the NAS has been examined and exposed credentials have been replaced. Our hacked password response guide helps organise that final step.
