Synology Pushes Emergency Patches and Warns of Active Attacks Targeting PHP2Shell Vulnerabilities and Older NAS Systems

Network-attached storage (NAS) giant Synology has been working to neutralize a series of critical security flaws following emergency patches released by PHP developers. The company has confirmed that several of its proprietary software packages are impacted by the newly exposed vulnerabilities, prompting an urgent security response across the global user base. The situation has intensified significantly following reports that malicious actors are actively exploiting the security holes in the wild. Consequently, the United States Cybersecurity and Infrastructure Security Agency (CISA) has formally added the flaws to its heavily monitored Known Exploited Vulnerabilities catalog.

The unfolding security crisis has also forced Synology to extend vital security patches to older versions of its DiskStation Manager (DSM) operating system. This broader deployment comes on the heels of a separate, alarming ransomware campaign that has been actively targeting outdated, unpatched NAS infrastructure across the internet.

Synology is strongly urging all device owners and system administrators to install the latest available security updates immediately. The advisory follows the discovery that attackers are leveraging an older vulnerability—initially patched by the manufacturer back in December 2024—to compromise systems, encrypt stored data, and demand financial ransoms from affected users.

This wave of attacks coincides with Synology’s ongoing investigation into two recently disclosed PHP2Shell flaws, which have been cataloged internationally as CVE-2026-109618 and CVE-2026-109619. When the vulnerabilities first came to light, the company’s Product Security Incident Response Team (PSIRT) clarified that the flaws do not inherently affect every Synology NAS device running the DSM software. Instead, the risk is concentrated within specific third-party and native applications that rely heavily on the underlying PHP environment to function.

The software packages officially identified as vulnerable include Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress. Individuals and businesses running any of these packages on their Synology hardware are advised to check for updates through the platform’s interface as soon as possible to mitigate potential exposure.

Older versions of the DSM are not immune

Recognizing the severe risk posed by active exploitation, Synology has taken the unusual step of releasing critical PHP security updates for DSM versions 7.4 and 7.3, alongside much older, officially unsupported software iterations including DSM 7.2, 7.1, 7.0, and even the legacy DSM 6.2 release. This unusually wide deployment represents an extensive patching effort by the manufacturer, particularly given that several of these operating system branches have long reached their end-of-life status and are no longer actively maintained under normal support lifecycles.

To secure their environments, system administrators and home users are instructed to navigate to the Package Center within their DSM dashboard and apply the necessary PHP updates for all affected applications. Once these updates are successfully installed, the dependent packages should automatically restart, thereby neutralizing the PHP2Shell vulnerabilities on the system. However, administrators should note that there are exceptions to this automated process. Most notably, the MailStation package requires a manual update procedure directly within the Package Center, meaning users cannot entirely rely on background automation to handle every single component.

For users maintaining legacy hardware running DSM versions predating 6.2, the remediation path is more restrictive. Because these ancient operating systems cannot receive direct architectural patches, Synology strongly recommends temporarily disabling all affected packages to drastically reduce external exposure before eventually planning an upgrade to a modern, supported DSM release.

Your Synology NAS is not necessarily the problem

As panic spread across various user forums and technical communities following the initial advisory, Synology’s security team moved to clarify another critical detail regarding the architecture of the DSM operating system. Many users naturally assumed that every single PHP-related component residing on their network-attached storage device was inherently vulnerable to the newly discovered exploits.

However, the manufacturer pointed out that DSM features an internal, native PHP component that is strictly utilized for core system operations and administrative housekeeping. According to rigorous assessments conducted by the company’s security engineers, this specific internal component features no externally accessible modules. Because it lacks exposure to the outside world, it does not provide potential attackers with an exposed attack surface or a viable vector through which the PHP2Shell flaws can be leveraged.

Consequently, Synology’s security team has formally assessed the risk level of the internal PHP component as low. Despite the minimal actual risk, the company has confirmed that a dedicated patch addressing this internal component will be bundled into a future DSM update. This upcoming software revision is primarily intended to ensure consistency across vulnerability scanning tools and compliance reporting software, helping system administrators avoid false positives during routine security audits.