NAS, Plex and port forwarding: checking what your office exposes to the internet
In its review of 3 November 2026 the Federal Office for Cyber Security reports several malware cases that entered through unpatched devices reachable from the internet, citing PHP and the Plex media server, whose flaws are actively exploited. Many small offices use the same set-up: what to check on routers, NAS and remote access, and what the Swiss data protection act requires.
On 3 November 2026 the Federal Office for Cyber Security (FOCS) devoted its weekly review to home networks that have become a gateway for cybercriminals. The FOCS has received several reports of malware on private networks: the entry point is the combination of devices reachable from the internet and unpatched vulnerabilities. If ransomware is then installed, photos and documents may be lost for good.
The FOCS is talking about home networks, but the same set-up is found in many small offices, practices and shops: a router supplied by the provider, a NAS for shared documents, a few cameras and a remote access opened years ago for convenience. It also applies to the home networks of staff working remotely.
What the FOCS reports
Today most providers deliver their routers in "router" mode: internal devices sit in a private network and cannot be reached directly from the internet. To use a service from outside, for example the NAS or a camera, many people enable port forwarding (or NAT): a single internal service is made visible from outside. If that service has an unpatched vulnerability, it becomes a target.
The FOCS cites two current examples. The first is PHP, for which it had already issued a warning on 21 October: PHP often runs behind the interfaces of NAS and other devices without this being obvious. We covered it in our article on the PHP vulnerabilities. The second is the Plex media server: according to the FOCS, anyone who has not updated it risks having the device taken over completely, and the reports received show that the threat is real.
Once inside, attackers can, according to the FOCS, install ransomware for extortion, steal data and blackmail the victim, use the computing power to mine cryptocurrency, or use the connection as a "residential proxy", routing strangers' traffic through the victim's internet line.
The Plex case
On 19 October 2026 Plex published an update to its security notice listing four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Chained together, they allow an unauthenticated remote attacker to run code with the privileges of the Plex Media Server process. According to Plex the flaws are being actively and widely exploited since a proof of concept was published on 16 October; compromised servers have been used to mine cryptocurrency and as proxies. On 20 October the US agency CISA added them to its catalogue of known exploited vulnerabilities.
The fixed versions are Plex Media Server 1.43.3.10861 and later. The full build number matters: a 1.43.3 with a lower number is not fixed. The number is shown in Plex Web under Settings, General. Plex warns that a server older than this version and reachable from the internet should be assumed to be potentially compromised. In that case updating is not enough: Plex recommends rebuilding the server from a clean installation rather than reusing the old data folder, signing out all devices from the account, changing the password and treating everything the service could reach as exposed, such as mounted shares and credentials stored on the same machine. If remote access is not needed, it should be turned off.
What to check in your office
- Know what is exposed. In the router, check the list of port forwards and of rules created automatically (UPnP). Each entry needs an owner and a reason; those no longer needed should be closed.
- Update everything, not just the PCs. Router firmware, NAS system and apps, cameras, home automation and services such as Plex. On NAS devices, check that automatic updates are enabled and actually work: Plex notes that new versions may reach NAS package managers with a delay.
- Use a VPN instead of port forwarding. The FOCS specifically recommends a VPN (for example IPsec, OpenVPN or WireGuard): access is authenticated and encrypted and services are not exposed directly. Where possible, the VPN and any exposed services should be protected with a second factor; the differences between methods are explained in our article on the FOCS five levels.
- Strong passwords. For exposed services the FOCS recommends passwords of at least 12 characters with upper and lower case letters, digits and special characters, and a lock-out after a maximum number of failed attempts where the product allows it.
- Separate networks. Services visible from outside should not sit in the same network segment as the PCs and the NAS holding business data. Many routers offer a "DMZ" or a separate network; cameras and home automation are also better kept apart.
- Limit where access comes from. Consider whether access really needs to be possible from the whole internet. Some routers can restrict it to certain countries (geofencing).
- Keep a separate backup. If the NAS is the only place where data is stored, ransomware on the NAS hits all of it. You need at least one copy that cannot be reached from the network, checked with a test restore.
If you also run web servers and applications, the other vulnerabilities exploited in recent weeks are covered in our end-of-October overview.
How to spot an infected device
According to the FOCS this is not always easy: victims often only notice when they are blackmailed. One possible sign is a device that slows down, often with a fan that is unusually loud or runs non-stop, because mining software uses a lot of computing power. In the worst case the device has to be reinstalled, and the other devices on the same network should be checked by a specialist.
Obligations: data protection and reporting
If the compromised NAS or server held personal data of customers or staff, this is likely a data security breach. The Federal Act on Data Protection requires appropriate security measures (Art. 8 FADP) and, if the breach is likely to result in a high risk for the data subjects, a report as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC) through its reporting portal, as well as informing the data subjects where this is necessary for their protection (Art. 24 FADP).
The obligation to report a cyberattack to the FOCS within 24 hours applies to operators of critical infrastructure. Other companies can report voluntarily through the FOCS reporting form. In case of blackmail or financial loss, filing a police complaint is advisable; Suisse ePolice lists the nearest police station.
Frequently asked questions
Our NAS sits behind the provider's router: are we safe?
Only if none of its services has been made reachable from outside, either manually or automatically through UPnP or the manufacturer's remote access features. It is worth checking this in the router and in the NAS settings.
We only use Plex in the office, without remote access: do we need to update?
Yes. The greatest risk concerns servers reachable from the internet, but Plex recommends that everyone move to version 1.43.3.10861 or later, and an unpatched device remains a weak spot for the whole network.
We have updated: is that enough?
Not always. As the FOCS also points out, an update does not remove a compromise that has already happened. If the service was exposed while running a vulnerable version, look for signs of compromise and, if in doubt, reinstall.
Our approach
ElaraTeq Sagl helps SMEs and practices in Ticino take stock of what is reachable from the internet, replace port forwards with protected VPN access and plan updates and backups, with hosting in Switzerland and tailored consulting. For a check of your network you can contact us.
Sources
- FOCS, Week 44: How your home network can become a gateway for cybercriminals, 3 November 2026
- FOCS, Critical vulnerabilities in PHP: Install security updates immediately, 21 October 2026
- Plex, Important Security Update for Plex Media Server v1.43.2 and earlier, 1 September 2026, updated 19 October 2026
- CISA, CISA Adds Six Known Exploited Vulnerabilities to Catalog, 20 October 2026
- NVD: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656
- FOCS, reporting form; reporting obligation for cyberattacks on critical infrastructure
- FDPIC, portal for reporting data security breaches
- Fedlex, Federal Act on Data Protection (FADP), SR 235.1, Art. 8 and 24
