Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices. If your files and backups are stored there, they're probably at risk.
The vulnerabilities, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in. PHP is a scripting language used by web servers and some NAS services. The PHP development team released security updates on October 21 for versions 8.2 through 8.5. Amazon detected an attempted exploit on October 17, four days before the flaws were publicly disclosed.
For NAS owners, the threat affects both manufacturer-maintained software and applications running independently in Docker containers. The risk of remote attack depends on whether attackers can reach the vulnerable PHP service.
Synology has released updated PHP packages, available through its Package Center and download archive. Its advisory lists PHP versions 7.3 through 8.4, Mail Station, and Synology Calendar among affected products. Synology says its built-in PHP in Disk Station Manager isn't exposed to external attack surfaces. QNAP is still working on fixes and has not said when they will arrive. QNAP reports no attacks on its products, though exploit attempts against vulnerable PHP servers have been documented. Until patches are released, QNAP recommends disabling unnecessary port forwarding, UPnP, and remote-access services, and using a VPN for remote connections.
Source: AppleInsider · Summarized by HeadlinesBriefing