Synology rushes out more PHP2Shell fixes as hackers target outdated NAS systems

Credit: Patrick Campanale / How-To Geek Published Oct 30, 2026, 11:38 AM EDT Jefferson Mangubat is an experienced technology journalist who has reported on consumer electronics, software updates and big stories in the industry. He's now a Reporter at How-To Geek, and has built a solid reputation for delivering accurate, accessible, and insightful tech journalism. Prior to that, he was a tech reporter for Neowin, where he extensively covered hardware developments from Apple and Google, in addition to digital trends and application updates. Sign in to your How-To Geek account Synology has been scrambling to fix the PHP2Shell vulnerabilities since the PHP developers released emergency security patches on October 21, and the company confirmed that a number of its NAS packages were affected. Now the story has taken a twist, as Synology reports that attackers are exploiting the flaws, and the US cybersecurity agency CISA has added them to its Known Exploited Vulnerabilities catalog. Synology is now extending security fixes to older DiskStation Manager (DSM) versions, following the discovery of a separate ransomware campaign targeting outdated NAS systems. The company is urging NAS owners to install the latest security updates following the discovery of active attacks against older DSM systems. The attackers are exploiting a flaw that was first patched in December 2024, apparently to encrypt data on disk and hold it for ransom from the users they affect. The warning comes as Synology probes two recently revealed PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619. Its Product Security Incident Response Team (PSIRT) said previously that the flaws affect only some packages that depend on PHP, not all Synology NAS devices running DSM. The affected packages are Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress. If you’re running any of these on a Synology NAS, you’ll want to check for updates sooner rather than later. Older versions of the DSM are not immune Synology extends PHP2Shell fixes beyond supported systems Synology has released PHP security updates for DSM 7.4 and 7.3, as well as for the older, end-of-life versions DSM 7.2, 7.1, 7.0, and 6.2. That's a pretty wide rollout for an update, especially considering some of those operating system versions are no longer supported. Users should head to Package Center and update PHP for affected packages. Once the update is complete, the dependent packages should automatically restart, fixing the PHP2Shell vulnerabilities. The one exception is MailStation, which needs to be manually updated in Package Center, so don’t assume that everything is handled automatically. Instructions differ for those running DSM versions prior to 6.2. Synology recommends temporarily disabling affected packages to reduce exposure before upgrading to a supported DSM release. Your Synology NAS is not necessarily the problem DSM's internal PHP component has limited exposure There's another detail worth understanding before assuming every PHP component on your NAS is vulnerable. DSM also has an internal PHP component that is used for system operations. Synology says this component has no externally accessible modules, so it does not provide attackers with an exposed attack surface to exploit. The company’s security team has assessed the risk as low and will address the vulnerability in a future DSM update. This patch is meant to make vulnerability scan results and compliance status consistent.