Updating Plex Media Server closes the Plex2Shell entry point, but an exposed QNAP NAS may need investigation and cleanup as well. QNAP’s November 6 notice directs owners to review their devices after reports of suspected Plex compromises.
Install the available update through App Center > My Apps, then open Plex Web’s Settings > General and verify 1.43.3.10861 or later. The vulnerable application is Plex Media Server; QNAP says QTS and QuTS hero are not themselves affected by these flaws.
Check the earlier exposure, not just the current version
The QNAP remediation FAQ says to treat a NAS as potentially compromised if Plex was internet-reachable while running 1.43.2 or earlier. Check Plex Remote Access, router port 32400 forwarding, UPnP and myQNAPcloud automatic router configuration. Updating an installation that was never internet-reachable is sufficient for this issue, according to QNAP.
Preserve evidence before removing Plex
If you want QNAP to help confirm a compromise, copy the Logs folder first. It sits under Plex Media Server in the PlexData shared folder. Then remove Plex through App Center. In File Station, check for a remaining Plex Media Server folder: do not reuse that directory unchanged.
QNAP’s minimum residual-data instructions are to empty Codecs and inspect Preferences.xml for unfamiliar transcoder settings. Reinstall the patched release from App Center and do not restore the old Codecs contents; Plex fetches the required components again.
Plex’s own security notice lists suspicious child processes, unfamiliar .so or .dll files in Codecs, connections to proxystream.st and sustained CPU activity when nothing is playing as investigation leads. It names processes including myawesomeproxy, mylovelyminer and x12345. These checks support investigation; finding none does not establish that a previously exposed installation is clean.
Revoke access and reduce what remains exposed
Plex instructs users who find indicators or cannot rule out compromise to sign out every device from their Plex account, then change its password. It also says to treat shares and credentials accessible to the Plex service account as potentially exposed.
QNAP additionally recommends changing NAS administrator and user passwords, enabling two-step verification, and rotating secrets used by NAS services, including backup jobs and cloud connections.
If remote viewing is unnecessary, disable Plex Remote Access and remove direct port 32400 forwarding. QNAP recommends a VPN when remote access is needed. For unresolved compromise concerns, preserve evidence and contact QNAP Technical Support.
Image: AI-generated editorial illustration created for DaySec.
