Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix

Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices. If your files and backups are stored there, they're probably at risk.

PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in.

The PHP development team released security updates on October 21 for versions 8.2 through 8.5. The urgency isn't hypothetical, as Amazon detected an attempted exploit on October 17, four days before the vulnerabilities were publicly disclosed.

For NAS owners, the threat affects both software maintained by the manufacturer and applications running independently in Docker containers. In either case, the risk of a remote attack depends on whether attackers can reach the vulnerable PHP service.

Synology has patches while QNAP works on fixes

Synology has released updated PHP packages addressing the vulnerabilities. Its security advisory identifies PHP versions 7.3 through 8.4, Mail Station, and Synology Calendar among the affected products.

Updated PHP 8.2 and PHP 8.4 packages are available through Synology's Package Center and download archive. Owners should check the advisory for the status of other affected packages rather than assume every component has been patched.

Synology also distinguishes separately installed PHP packages from the PHP components built into DiskStation Manager. The manufacturer says its built-in PHP isn't exposed to external attack surfaces, making exploitation through that component unlikely.

QNAP confirmed a wider range of affected products in its October 22 advisory. The list includes QTS 5.2.11 and earlier, QTS 6.1.0, multiple versions of QuTS hero and QuTScloud, and applications such as Note Station 3.

The company is working on fixes but hasn't said when they will be available. QNAP reports no attacks targeting its products, though attempts to exploit vulnerable PHP servers have been documented.

Until patches arrive, QNAP recommends removing direct internet exposure by disabling unnecessary port forwarding, UPnP, and remote-access services. Owners who need remote connections should use a VPN and restrict management access to trusted networks.

Disabling the built-in web server can reduce exposure if the service isn't needed, but QNAP warns that doing so doesn't protect the NAS administration interface. Network restrictions remain necessary while the affected software is unpatched.

Other NAS manufacturers are still assessing the threat

TerraMaster has acknowledged the problem in a Reddit discussion after an owner reported finding PHP 7.4.33 running the management interface on an F2-425 NAS.

In an October 22 response, TerraMaster said its team was investigating and testing the issue and working toward a fix. We haven't independently confirmed that the reported configuration is exploitable, and there is not yet a patch.

We also haven't been able to confirm whether Ugreen has released a PHP2Shell security update for UGOS Pro. The company's vulnerability policy describes how it handles security reports, but doesn't establish whether its NAS software is affected by these vulnerabilities.

Similarly, we couldn't confirm a PHP2Shell patch or a definitive affected-device list from Asustor. The manufacturer maintains a security advisory page, although the status of the specific vulnerability is listed as "ongoing."

NAS owners should check their manufacturer's security notices and available updates for their specific models.

Docker containers need separate security updates

Even a fully updated NAS operating system may still be running vulnerable PHP software inside Docker containers. These applications can include their own PHP installations, which aren't necessarily updated when the manufacturer patches the NAS firmware.

Owners running PHP-based services in Docker should check their container images for affected versions and install updated images as they become available. Applying an image update generally requires recreating the container so it runs the patched software.

QNAP explicitly warns that PHP installations inside Container Station and third-party applications aren't covered by its operating-system updates. The Dutch National Cyber Security Center also recommends identifying PHP installations in third-party software and applying the appropriate fixes.

If an affected container can't be updated immediately, owners should disable public access or restrict connections until a patch arrives. These measures reduce the risk of remote attacks but can't replace the security fixes recommended by PHP developers.

Unsupported NAS devices shouldn't be exposed to the internet

The greatest long-term concern involves older NAS hardware that no longer gets security updates. When manufacturer support ends, vulnerabilities can remain unpatched indefinitely, leaving owners exposed to known security problems beyond PHP2Shell.

An unsupported NAS can still provide local file storage, but exposing its administrative interface or other services directly to the internet creates unnecessary risk. Owners should remove public access rather than assume older hardware will eventually receive a fix.

Blocking unsolicited inbound connections keeps the device accessible locally while allowing outbound traffic for updates and other services.

For remote access, owners should use a secure VPN instead of forwarding NAS management ports. They should also check logs for suspicious activity, since updates won't undo an existing compromise.