QNAP NAS owners: update Plex now to block Plex2Shell attacks

[Lucy_35]

If you run Plex on a QNAP NAS, it is time to check for updates. BleepingComputer reports that QNAP says hackers are breaching NAS devices through Plex2Shell, a chain of four Plex Media Server flaws

The flaws were exploited after details went public on 16 October, and the US cybersecurity agency CISA added them to its known exploited vulnerabilities list on 20 October. QNAP says only Plex is vulnerable, not its own QTS or QuTS hero systems

The fix is to update Plex Media Server to version 1.43.3.10861 or later through the App Center. Updating does not remove any malicious files already installed, though

If your Plex server was reachable from the internet, QNAP advises treating the NAS as compromised, doing a clean reinstall and resetting passwords. Closing port 32400 or using a VPN for remote access is also recommended

Home media servers are often set up once and forgotten, which makes them easy targets. Exposing Plex directly to the internet is convenient but risky, and a VPN is a much safer way to watch your films away from home. Checking for updates regularly is a good habit for any device on your network

Do you expose your media server to the internet? And how do you keep your NAS secure?

QNAP says hackers breaching NAS devices in Plex2Shell attackswww.bleepingcomputer.com

[Brad]

Moving Plex off my NAS onto a separate mini PC was worth it. If it gets compromised, my files are on another box. Separation adds a layer of safety. Worth considering for anyone with valuable data

[KernelKnight16]

Update Plex today if you use it on a NAS. Then check your router for port 32400. If it is open to the world, close it. Use a VPN instead. Simple steps prevent big problems

[HitmanMatt53]

NAS boxes hold everything people care about. Photos, documents and backups

Losing them to attackers would be devastating. Security deserves more attention than it gets

Most owners never check for updates. Automatic updates help a lot