Synology Ships a Plex2Shell Fix for Its NAS Package
Synology has released a fixed Plex Media Server package for four DSM branches. The release addresses Plex2Shell, a chain that can let a remote attacker run code with the privileges of the Plex process. Plex disclosed widespread exploitation of unpatched internet-facing servers in October. The 8 November release gives Synology owners an exact package build to check. Synology’s advisory · Plex’s disclosure
Check the Plex package build
Synology lists 1.43.5.11079-720011079 or later for DSM 7.3 and 7.4. For DSM 7.2.1 and 7.2.2, it lists 1.43.5.11079-700011079 or later. Check the full Plex version on each NAS running the package. The DSM operating system version identifies which package to use. The Plex package’s own build shows whether the fix is installed. Synology package versions
Review any server that was reachable while vulnerable
Plex describes four weaknesses that can be combined to reach internal functions, obtain the server owner’s admin token and write a file the Plex process can load. Plex has seen compromised servers running cryptocurrency miners and proxy software. QNAP separately reported suspected compromises on 6 November and published guidance for its own package. CVE-2026-96652 · CVE-2026-96654 · CVE-2026-96655 · CVE-2026-96656 · Plex’s exploitation update · QNAP’s notice
If an older Plex build was internet-facing, preserve its logs and review Plex’s compromise and clean reinstall guidance before restoring remote access. Check router port forwards as well as the Plex Remote Access setting. Treat unexpected processes or outbound connections as evidence to investigate after the patch is applied. Plex’s recovery guidance
