Synology NAS owners are urged to take their devices offline and manually update immediately, especially older models. Recent PHP vulnerabilities have led to widespread server patches, but home NAS units are also at risk. Many users discovered their devices were attacked by ransomware due to unpatched software.
Attackers exploited PHP flaws to encrypt data, with reports of 70TB encrypted and ransom demands of $3,000 in Bitcoin. While patches exist, some Synology devices failed to update automatically. Older models may not have auto-updates enabled by default, and users might see false 'up-to-date' messages.
Synology's DSM manual confirms auto-updates for 2025+ models but is silent on older hardware. The issue isn't missing patches but failed implementation. Users should verify their NAS is truly updated and enable manual checks if needed.
Source: AppleInsider · Summarized by HeadlinesBriefing