QNAP and Synology Both Say Their NAS Devices Are Being Breached This Week, One Through Plex and One Through a Two-Year-Old Bug. Do You Know Which Storage Boxes Face the Internet?

Two NAS vendors issued warnings within days of each other: QNAP says attackers are breaching devices through the Plex2Shell vulnerability chain in Plex Media Server, and Synology says ransomware operators are encrypting NAS devices that run outdated DSM. According to BleepingComputer's reports on QNAP (6 November 2026) and Synology (2 November 2026), the common thread is not a new zero-day. It is storage that is reachable from the internet and not kept up to date.

QNAP: Plex2Shell

• The flaws: Plex2Shell is a chain of four Plex Media Server vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Researcher Zach Main reported them to Plex, and exploitation began shortly after full technical details became public on 16 October.
• Known exploited: CISA added all four to its Known Exploited Vulnerabilities catalog on 20 October and told federal agencies to upgrade to Plex 1.43.3.10861 or later within three days.
• QNAP's statement: QNAP says it has received reports that Plex Media Server on some users' NAS devices appears to have been compromised through these flaws. It says the vulnerabilities are in Plex Media Server only, and QTS, QuTS hero and other QNAP operating systems are not affected.
• Advice: update Plex to 1.43.3.10861 or later from the App Center. If a vulnerable Plex server was exposed to the internet, QNAP says to treat the NAS and its content as compromised, because updating does not remove payloads already installed. It recommends a clean reinstall of QTS or QuTS hero and a reset of Plex and NAS credentials, and says to stop forwarding port 32400 and use a VPN if remote access is needed.

The report does not give the number of affected devices or name the attackers.

Synology: C3RB3R ransomware

• The warning: Synology says it has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated DSM, with the aim of encrypting data and demanding ransom. It has not said which flaw. It points to its November 2024 advisory Synology_SA_24_20, which covers CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445.
• The ransomware: victims report a ransom note named read-me3.txt and files renamed with a .L0CK3D extension. The note demands payment of thousands of dollars for a "C3rb3r Decryptor" and offers a free restore of one file. The name echoes the Cerber operation of 2016 to 2019, though the report does not link the current attacks to those earlier ones.
• Fixed versions: DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, or 6.2.4-25556-8 and above, depending on your branch.
• Advice: update DSM, enable automatic updates, and block access to the management web interface from the internet.
• Scale: Shadowserver tracks over 380,000 internet-exposed Synology NAS devices, although it does not say how many are already patched or are honeypots. Synology rarely issues warnings like this; its previous one was in August 2019.

What the two cases share

Neither involves an exotic technique. A media server was published to the internet, and a management interface was reachable on a build that was almost two years behind on patches. NAS devices are easy to forget: they are bought for a project, plugged in, port-forwarded for convenience, and then absent from the patching cycle because they are not laptops or servers. They are also where backups and shared files live, which is why ransomware operators want them.

What to do

1. List every NAS you own, including ones in branch offices, labs and home offices used for work.
2. Check what is reachable from outside: the DSM or QTS management interface, Plex on port 32400, and any other forwarded ports. Close what does not need to be public and put the rest behind a VPN.
3. Update DSM, QTS and Plex now, and turn on automatic updates where the vendor offers them.
4. For any Plex server that was internet-facing before patching, follow QNAP's compromise guidance instead of assuming a patch is enough.
5. Confirm backups are not reachable from the same NAS they protect. An offline or immutable copy is what makes ransomware recoverable.

How Obiguard Scout fits

The first two steps are an inventory problem. Obiguard Scout is our external attack surface product. It maps the hosts and services your organisation exposes to the internet, so a NAS management page or an open Plex port shows up in a list of what is reachable, alongside the software it appears to be running, and changes to that list are flagged. That tells you which devices to patch or take offline first. Scout sees only what is visible from outside: it cannot confirm that a device is already compromised, inspect files on it, or apply an update, and a NAS on a private network with no exposure will not appear. You can run a free Scout check on a domain you own to see what is already published under it, or get in touch to talk through coverage.

Sources

• BleepingComputer: QNAP says hackers breaching NAS devices in Plex2Shell attacks
• BleepingComputer: Synology warns of C3RB3R ransomware attacks targeting NAS devices
• QNAP security notice: Plex2Shell
• Synology advisory Synology_SA_24_20