MeridianMeridian

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server

Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.

SecurityWeekTranslated from English

Read at source

Threat actors are exploiting Plex2Shell to hack into Plex Media Server applications on QNAP NAS devices, Taiwanese storage and networking solutions provider QNAP warns.

Plex2Shell is a chain of four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656) in Plex Media Server that was patched this summer. Widespread exploitation of the four-flaw chain started in mid-October, after technical details and proof-of-concept (PoC) code were published.

Successful exploitation of Plex2Shell does not require valid credentials and could allow attackers to execute arbitrary code on exposed servers, with the privileges of the Plex service. Plex Media Server is available as a third-party application to QNAP NAS users, through the official App Center.

“QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through these vulnerabilities,” the Taiwanese firm warned on Friday.

“The QNAP Technical Support team is assisting affected users and has confirmed that no data loss has occurred. The QNAP PSIRT has confirmed that the vulnerabilities exist only in Plex Media Server; QTS, QuTS hero, and other QNAP operating systems are not themselves affected,” it added.

QNAP NAS users are advised to update to Plex Media Server version 1.43.3 or later as soon as possible. Devices accessible from the internet should be considered potentially compromised and Plex should be reinstalled, QNAP says, adding that the passwords for both Plex and the NAS should be immediately rotated.

“If you do not need remote access to Plex, disable Plex Remote Access and do not forward port 32400. If you do need remote access, use a VPN instead. Also make sure QTS or QuTS hero and all installed apps are up to date,” QNAP says. The company has published a step-by-step remediation guide to help users identify and respond to potential compromises.

Plex2ShellPlex Media ServerQNAP NASCVE-2026-96652QNAP PSIRTQTS
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems
Vulns & Exploits

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

BleepingComputerNov 9, 2026Translated from English

CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog
Vulns & Exploits

CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog

CISA has added one new entry to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-19868, affects SonicWall SonicOS SSLVPN and stems from the use of single-factor authentication. This flaw allows attackers to bypass stronger authentication controls and gain unauthorized access to VPN services. The addition triggers mandatory remediation timelines for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. CISA emphasizes that the vulnerability poses significant risks because successful exploitation can grant attackers full control over affected assets. Organizations outside the federal sector are strongly encouraged to adopt the same risk-based prioritization approach.

CISA AlertsNov 9, 2026Translated from English

Default 'admin:admin' Credentials in ForgeRock Servers Allow Researchers to Remotely Unlock and Start Vehicles from Two Automakers
Vulns & Exploits

Default 'admin:admin' Credentials in ForgeRock Servers Allow Researchers to Remotely Unlock and Start Vehicles from Two Automakers

Security researchers Shubham Shah and Sam Curry discovered that two unnamed automakers relied on ForgeRock identity platform instances with an exposed Apache Felix administrator console protected only by the default 'admin:admin' credentials. By bypassing edge protections through specially crafted URLs containing encoded slashes, the researchers gained full access to customer records stored in OpenIDM and could impersonate any user account. Once authenticated through the mobile apps, they obtained valid access tokens that enabled them to unlock doors and start engines on connected vehicles in the United States, Canada, and Australia. The researchers limited full vehicle testing to their own cars and vehicles belonging to consenting owners, reporting the issues in February 2026; both affected systems were patched within approximately two hours. A separate attack path in Australia involved hardcoded administrator credentials left in the application code from a test environment. The incidents highlight persistent misconfigurations in identity management deployments rather than novel product vulnerabilities, with no CVE assigned. The researchers have previously disclosed similar remote vehicle access issues affecting Honda, Kia, and Subaru.

The Hacker NewsNov 9, 2026Translated from English