Plex2Shell is a chain of four flaws in Plex Media Server, disclosed on October 16 and exploited shortly after. CISA added all four to its Known Exploited Vulnerabilities catalog on October 20. QNAP said it received reports from several users of compromised Plex installations on their NAS devices, and that the flaws are only in Plex, not in its QTS and QuTS hero operating systems.
According to BleepingComputer, updating to Plex 1.43.3.10861 through the QNAP App Center closes the flaws but does not remove payloads already installed. Owners whose server was exposed should check for signs of compromise listed in QNAP's bulletin, reinstall the operating system and reset Plex and NAS credentials.
Users who do not need remote access to Plex should disable it and stop forwarding port 32400; those who do should connect through a VPN. QNAP published a step-by-step remediation guide and offers to review logs from suspected compromises through its support portal.