Synology and QNAP NAS and the PHP vulnerability

MacWindowsUpdated

Synology and QNAP both published advisories on 22 October 2026 about PHP2Shell, the two critical PHP flaws announced the day before. As of 23 October 2026, Synology's fixes are out in Package Center. QNAP's are not: its advisory lists the fixed versions as "to be announced" and gives steps to cut your NAS off from the internet until then.

Quick answer

Synology owners: open Package Center, click Installed, and update every package, especially any PHP package, Synology Calendar and Mail Station. Synology rates the built-in DSM PHP as very low risk. QNAP owners, as of 23 October 2026: no fix yet, so disable port forwarding and UPnP, and use a VPN for remote access.

Does PHP2Shell affect my Synology NAS?

Possibly, depending on what you've installed. Synology's advisory, Synology-SA-26:14, published on 22 October 2026, rates the issue Critical and marks it Resolved. It says the vulnerabilities let remote attackers run code through susceptible versions of certain DSM packages. It also says the PHP built into the operating system isn't exposed to external attack surfaces, and puts the risk of exploitation there as very low.

So the exposure Synology describes is in the packages you add from Package Center, not in DSM itself. As of 23 October 2026, these are the fixed versions it lists:

  1. Synology Calendar 3.0.4-21435 or later.
  2. Mail Station 30000002.3.19-20333 or later.
  3. PHP 7.4: 7.4.33-0131 or later.
  4. PHP 8.0: 8.0.30-0122 or later.
  5. PHP 8.1: 8.1.34-0120 or later.
  6. PHP 8.2: 8.2.35-0171 or later.
  7. PHP 8.3: 8.3.36-0051 or later.
  8. PHP 8.4: 8.4.27-0051 or later.

Synology says no fix will be provided for the PHP 7.3 package, because that version has reached end of life.

How do I update packages on a Synology NAS?

Synology's own help page for Package Center calls keeping packages up to date the best practice for the health of your NAS. You update them from the Installed list.

  1. Sign in to DSM in your web browser and open Package Center.
  2. Click Installed on the left panel. Packages with an update waiting show it there.
  3. Click Update next to each one, or Update All to do them in one go.
  4. Check the version numbers against the list above, especially for any PHP package.
  5. To choose how updates arrive in future, go to Settings > Auto Update in Package Center.
  6. To be told when updates are available, go to Settings > General > Notification, tick the boxes and click OK.

Do I need PHP on my Synology NAS?

DSM has its own built-in PHP, which Synology rates as very low risk. The PHP 7.4 to 8.4 packages are separate: they show up in Package Center's Installed list if you, or a package you installed, added them.

  1. Open Package Center and click Installed.
  2. Look for packages named PHP followed by a version number.
  3. If you host websites with Web Station, Synology's notice on older PHP versions says each site runs on a PHP Profile chosen in Web Station's settings. Synology recommends PHP 8.1 or 8.2, and says to switch any site still on PHP 7.3, 7.4 or 8.0.
  4. Update every PHP package that's there to the fixed version.

Package Center also lets you uninstall a package. If you added a PHP package for something you no longer use, that's an option, but check first that nothing else you run depends on it.

Is my QNAP NAS affected?

Yes, if it runs an affected version. QNAP's advisory, QSA-26-18, published on 22 October 2026 and rated Critical, lists these among the affected products. As of 23 October 2026 every one is marked "Fixing", with the fixed version "To be announced".

  1. QTS 6.1.0, and QTS 5.2.11 and earlier.
  2. QuTS hero h6.1.0, h6.0.x, and h5.2.11 and earlier.
  3. QuTScloud c5.2.9 and earlier.
  4. Note Station 3, version 3.9.14 and earlier.

The advisory also names QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier on ARM32 models, TVR OS 1.0.4 and earlier, and QuMagie 2.10.1 and earlier. As of 23 October 2026, QNAP says exploitation attempts against PHP have been publicly reported, but that it has received no reports of exploitation targeting its products. Its advisory may change once fixes ship, so check the page again before relying on this list.

What should I do with my QNAP NAS until a fix arrives?

QNAP says that until fixed versions are available, the most effective protection is to keep the device off the internet. Its steps reduce exposure but don't fully fix the flaws.

  1. On your router, disable port forwarding for the NAS, and disable UPnP.
  2. On the NAS, go to myQNAPcloud > Auto Router Configuration and disable UPnP port forwarding.
  3. If you don't need them, disable myQNAPcloud Link and unpublish services under myQNAPcloud > Publish Services.
  4. For access from outside the house, connect through QVPN Service or your router's VPN rather than opening web ports.
  5. In QuFirewall, or Control Panel > System > Security > Allow/Deny List, allow the management ports (8080 and 443 by default) only from trusted networks or VPN addresses.
  6. In App Center, stop affected apps you don't need. Back up their settings and data before uninstalling anything.
  7. If you don't use the web server, disable it under Control Panel > Applications > Web Server.

QNAP says stopping apps and switching off the web server don't protect the NAS's own web admin page, and that cutting internet access, using a VPN and limiting the management ports (steps 1 to 5 here) remain the main protections.

What if I think my NAS has already been compromised?

QNAP gives specific steps for its devices. The NCSC's advice, for a PHP system that can't be updated straight away, is to check it for signs of compromise and backdoors before you upgrade. An update doesn't remove anything an attacker has already installed.

  1. On a QNAP, review QuLog Center for logins or access you don't recognise.
  2. Run Security Center and Malware Remover with up-to-date definitions.
  3. If you suspect compromise, QNAP says to disconnect the device, change all passwords and contact QNAP Support.

More questions

Does a DSM update fix PHP2Shell on Synology?

Synology's advisory, as of 23 October 2026, lists fixed package versions rather than a DSM update. It rates the PHP built into DSM as very low risk. The fix is to update your packages in Package Center.

When will QNAP release a fix?

QNAP hasn't said. As of 23 October 2026 its advisory, still at its first version, lists every affected product as "Fixing" with the fixed version "To be announced". Check QSA-26-18 again, as the date and versions may change.

Is PHP inside Docker or Container Station covered?

Not by QNAP's updates. QNAP says PHP inside Container Station containers or third-party applications isn't covered, and to contact the image or application provider for a fixed version. Synology's advisory doesn't mention containers.

Is my NAS at risk if it never connects to the internet?

QNAP calls keeping the device off the internet the most effective protection until a fix arrives. It also notes that limiting access to trusted networks doesn't protect against devices on your home network that are already compromised.

What is PHP2Shell?

It's the name used for two critical flaws in PHP, CVE-2026-109618 and CVE-2026-109619, announced on 21 October 2026. Our PHP2Shell explainer covers the flaws and the fixed PHP versions.

Sources