How to disable UPnP and port forwarding, and why QNAP says to

MacWindowsUpdated

QNAP's PHP2Shell advisory, QSA-26-18, tells owners of affected NAS drives to disable port forwarding for the NAS on their router and to disable UPnP on the router. As of 23 October 2026 QNAP has no fixed versions out, and it says keeping the device off the internet is the most effective protection until it does.

Quick answer

UPnP lets devices on your network find each other and gives them control of settings such as port forwarding. CISA advises turning UPnP off unless you have a specific need. For QNAP NAS drives, QNAP says to switch off both UPnP and port forwarding until a fix ships, and to use a VPN for remote access.

What do UPnP and port forwarding do?

UPnP, short for Universal Plug and Play, is a protocol that lets devices on the same network find and talk to each other automatically. The Canadian Centre for Cyber Security says it also offers control of network settings such as port forwarding, and that attackers can use this to get past firewalls. CISA describes the upside plainly: UPnP lets you connect smart devices in your home easily.

Port forwarding is a rule on your router for a particular device. QNAP's advisory puts turning it off under keeping the NAS off the internet, and offers a VPN as the way to reach the NAS instead of exposing web ports directly.

QNAP NAS drives also have a UPnP feature of their own, Auto Router Configuration in myQNAPcloud, which the advisory calls UPnP port forwarding.

Why does QNAP's advisory say to turn them off?

Because there's no fix yet. QNAP says that until fixed versions are available, the most effective protection is to keep the device off the internet. Its advisory, published on 22 October 2026 and rated Critical, says the PHP flaws could let unauthenticated remote attackers run arbitrary code on an affected device. As of 23 October 2026 every affected product is listed as "Fixing", with the fixed version "To be announced".

QNAP's own steps are to disable port forwarding for the NAS on your router, disable UPnP on the router, and disable UPnP port forwarding under myQNAPcloud > Auto Router Configuration on the NAS. It says these steps reduce exposure but don't fully fix the vulnerabilities.

On exploitation, QNAP says, as of 23 October 2026, that attempts against PHP have been publicly reported, and that it has received no reports of exploitation targeting QNAP products. Our NAS guide has QNAP's full list of affected products and the rest of its steps.

Should I turn off UPnP?

CISA's answer is yes, unless you have a specific need for it. Its Home Network Security page says malware inside your network can use UPnP to bypass your router's firewall. Its home Wi-Fi guide adds that threat actors can use UPnP to spread malware to devices on your network and control them remotely.

There's a catch. CISA says you may need UPnP switched on to add a device to your network in the first place, and should turn it off afterwards. The Canadian Centre for Cyber Security says some devices need UPnP to work properly, so check what yours need before you disable it.

How do I check UPnP and port forwarding on my router?

There's no single set of steps, because every router's menus differ. CISA says to refer to your own router's user guide for the step-by-step instructions, and to the maker's manual for how to sign in to the router at all.

  1. Sign in to your router's admin page or app. CISA says the default sign-in details may be on a sticker on the router.
  2. Look for the UPnP setting. The Canadian Centre for Cyber Security says it's often under an advanced section or the NAT forwarding settings.
  3. Switch UPnP off and save.
  4. Find the port forwarding list and review each rule. The Canadian Centre for Cyber Security suggests reviewing these rules regularly. For a QNAP NAS, QNAP says to disable its port forwarding.
  5. While you're there, check for a firmware update. CISA says routine updates protect you against known vulnerabilities.
  6. On a QNAP NAS, also go to myQNAPcloud > Auto Router Configuration and disable UPnP port forwarding.

If a device stops working afterwards, it may be one of those that needs UPnP. Your router maker's manual covers that model's settings.

How can I reach my NAS from outside without port forwarding?

Through a VPN. QNAP says to use a VPN for remote access, connecting through its QVPN Service or your router's VPN instead of exposing web ports directly. Netgate gives the same advice for the pfSense admin page: reach it only by secure means, such as a VPN.

QNAP's other steps, including limiting the NAS's management ports, are in our NAS guide. The update is still needed when it comes.

Where Failshot fits

Failshot is second layer device security. Your password is the first layer. Failshot is the second: it photographs whoever unlocks your Mac while it's on, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed.

It's for the moment someone sits down at your Mac and unlocks it.

With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for Mac, on macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Can I turn UPnP back on later?

Yes. CISA says you may need UPnP on to add a device to your network in the first place, and that you should turn it off again afterwards. The switch is in the same place in your router's settings.

Should I turn off remote management on my router too?

CISA advises it, as a separate step from UPnP. It says remote management lets you log in to your router over the internet to change its settings, and that switching it off means someone has to be on your network first. Our router guide covers this alongside PHP2Shell.

What if I can't turn UPnP off?

The Canadian Centre for Cyber Security says disabling it entirely is the most effective protection against UPnP-related attacks. Where that isn't possible, it suggests keeping devices updated and reviewing your router's port forwarding rules, among other steps.

Will turning off UPnP fix PHP2Shell?

No. QNAP says its steps reduce exposure but don't fully fix the vulnerabilities, and the PHP project says only an update is a complete solution. Turning UPnP and port forwarding off makes the NAS harder to reach while you wait.

Does PHP2Shell affect my router?

Only if your router runs PHP, which only its maker can tell you. Netgate and the OPNsense team have published fixes for pfSense and OPNsense. Our router guide has what each one says.

Sources