Synology has been scrambling to fix the PHP2Shell vulnerabilities since the PHP developers released emergency security patches on October 21, and the company confirmed that a number of its NAS packages were affected.Now the story has taken a twist, as Synology reports that attackers are exploiting the flaws, and the US cybersecurity agency CISA has added them to its Known Exploited Vulnerabilities catalog.Synology is now extending security fixes to older DiskStation Manager (DSM) versions, following the discovery of a separate ransomware campaign targeting outdated NAS systems.
Add How-To Geek on Google Add as Preferred Source Follow on Google Discover The company is urging NAS owners to install the latest security updates following the discovery of active attacks against older DSM systems.The attackers are exploiting a flaw that was first patched in December 2024, apparently to encrypt data on disk and hold it for ransom from the users they affect.The warning comes as Synology probes two recently revealed PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619.
Its Product Security Incident Response Team (PSIRT) said previously that the flaws affect only some packages that depend on PHP, not all Synology NAS devices running DSM.Related I've been a Synology die-hard for years, but this brand finally won me over Ugreen vs Synology: Who makes the better NAS in 2026? Posts 1 By Patrick Campanale The affected packages are Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress.If you’re running any of these on a Synology NAS, you’ll want to check for updates sooner rather than later.
Older versions of the DSM are not immune Synology extends PHP2Shell fixes beyond supported systems Synology has released PHP security updates for DSM 7.4 and 7.3, as well as for the older, end-of-life versions DSM 7.2, 7.1, 7.0, and 6.2.That's a pretty wide rollout for an update, especially considering some of those operating system versions are no longer supported.Users should head to Package Center and update PHP for affected packages.
Once the update is complete, the dependent packages should automatically restart, fixing the PHP2Shell vulnerabilities.The one exception is MailStation, which needs to be manually updated in Package Center, so don’t assume that everything is handled automatically.Instructions differ for those running DSM versions prior to 6.2.
Synology recommends temporarily disabling affected packages to reduce exposure before upgrading to a supported DSM release.Your Synology NAS is not necessarily the problem DSM's internal PHP component has limited exposure There's another detail worth understanding before assuming every PHP component on your NAS is vulnerable.DSM also has an internal PHP component that is used for system operations.
Synology says this component has no externally accessible modules, so it does not provide attackers with an exposed attack surface to exploit.The company’s security team has assessed the risk as low and will address the vulnerability in a future DSM update.This patch is meant to make vulnerability scan results and compliance status consistent.
Related Why the "Synology tax" is still worth paying in 2026 Synology is overpriced, but I’m still buying one in 2026 Posts 1 By Patrick Campanale
Read More
