If your business keeps backups or shares files on a QNAP NAS, and that device also runs the Plex media app, you need to stop and check it today. QNAP has confirmed that attackers are actively breaking into NAS devices through a set of vulnerabilities nicknamed "Plex2Shell" — and simply installing the fix does not undo any damage already done.
What happened
On 6 November 2026, QNAP issued a security notice about Plex2Shell, a chain of four unauthenticated vulnerabilities in the third-party Plex Media Server application that many QNAP owners install through the App Center for remote access to photos, videos and music. A patched build, Plex Media Server 1.43.3.10861 or later, is now available in the App Center.
The problem: QNAP says it has already received reports from users whose Plex Media Server was compromised through these flaws, and its technical support team is actively assisting affected customers. According to BleepingComputer, QNAP is blunt about the risk: if your NAS was running a vulnerable, internet-exposed Plex server, you should treat the device and all personal content on it as compromised, not just outdated.
German outlet heise.de adds that Plex itself says attackers are using hijacked servers to run crypto-miners and proxy software — turning your business storage box into someone else's infrastructure, silently drawing power and bandwidth while possibly sitting on top of your backups.
One piece of good news: the vulnerabilities sit in the Plex app, not in QNAP's own operating systems. QTS and QuTS hero are not affected. This is about the bundled third-party app, not the NAS platform itself.
Do this today
- Check if Plex Media Server is installed on any QNAP NAS in your business, even one set up years ago for a one-off project and forgotten since.
- Check if that NAS is exposed to the internet — directly, through port forwarding, DMZ settings, or QNAP's myQNAPcloud remote access. If yes, assume compromise until proven otherwise.
- Do not just click update. QNAP's own guidance, per heise.de, is to remove Plex Media Server entirely following QNAP's instructions, then do a clean reinstall of version 1.43.3.10861 or later rather than updating in place.
- Look for signs of compromise before and after reinstalling: unexpected high CPU or fan activity (a classic crypto-miner symptom), unfamiliar scheduled tasks or user accounts, unexplained outbound network traffic, and any files or folders you don't recognise.
- Change passwords for the NAS admin account and any accounts that shared credentials with it, and review two-factor authentication on remote access.
- Isolate exposed devices from the public internet while you investigate — disable port forwarding and remote access until you're confident the device is clean.
Why this matters for Swiss SMEs
QNAP NAS devices are a common, low-cost backup and file-sharing solution for small and medium Swiss businesses — often set up once by whoever was around at the time, then left running quietly for years with remote access enabled "just in case." That is exactly the kind of device attackers are now finding and exploiting at scale through Plex2Shell. A compromised NAS sitting on your backups is a double risk: it can quietly mine crypto or route malicious traffic today, and it may not be trustworthy as a recovery point if ransomware hits tomorrow.
How TMC can help
This is the kind of quiet infrastructure risk that's easy to miss when nobody is actively watching your network day to day. The Mejlerö Company (TMC) offers Swiss SMEs in Obwalden, Nidwalden, Lucerne and Zurich a free network analysis and a free one-hour consultation, where NAS devices, remote access settings and endpoint protection get a proper look. If you're not sure whether your storage and backup setup is exposed, or you want outside help checking and cleaning up a device, reach out to Andrii Okraichenko and the team at 044 500 99 47.
We'll keep watching this space and reporting on the vulnerabilities and attacks that matter most to Swiss business owners, so you know what needs attention now and what can wait.
Switzerland.