Synology NAS owners should take the network storage devices offline and manually update them as soon as possible, especially for older units.

The discovery of vulnerabilities in PHP led to large sections of the Internet updating servers to patch the software flaws. This doesn't just affect commercial webservers, as it is also a problem for home NAS units, including those with services that are accessible over the Internet.

The PHP fiasco should've been a warning for everyone to start updating their devices more regularly. Not just to protect against the PHP vulnerabilities, but other existing and older security threats too.

The problem is that, while some NAS vendors have patches available to fix security issues, not all devices will get that crucial update automatically. For some users, they really need to check their network hardware.

In some cases, while the software may say there are no updates available, there may be some important ones it's not telling you about.

This seems to be what's happened to some Synology users.

Not exactly up-to-date

As explained by Toms Hardware with other reports also surfacing, some users are discovering their NAS is being attacked by ransomware. Attackers exploited the PHP vulnerability and had encrypted their data.

The report references one Reddit report of a Synology DS918+ being attacked by ransomware. In that instance, the user employed 3-2-1 backups, so they ultimately didn't lose their data.

Their breakdown of the attack revealed that the fix against that attack was available in "Update 6" released in November 2024. Their NAS was on the previous update.

Another Reddit user explained there was an attack on their Synology DS2422+ on October 29. Referred to as a "C3RB3R" attack, 70TB of data was encrypted as part of a similar ransomeware attack, complete with a demand of $3,000 in Bitcoin.

The real problem here wasn't the lack of availability of patches, but the implementation of them. Or really, how some hardware still automatically updates and others seem like they do, but really they don't do it.

Synology's DSM manual states that devices from 2025 and later have automatic updates, but doesn't say about older hardware being set up the same way. This seemingly indicates that older models don't have this functionality enabled by default, and have to be set up to update automatically.

Further complicating things is that users are checking their NAS units and seeing messages along the lines of "You are fully updated to the latest version," though really the NAS stopped automatically updating in the background.

Ideally, the message should've said that automatic updates were ceased for some reason, such as an End of Life update policy, prompting users to manually run updates.

As a result, some users are checking their NAS and seeing everything is fine and "up to date" as far as the NAS itself is concerned. But the reality is that it's lagging behind and still vulnerable.

Be proactive about security

To anyone with a Synology NAS, or quite frankly any device that can be accessed from outside the local network, AppleInsider recommends setting up a schedule to regularly check for updates.

This doesn't just mean checking an automatic updater tool and taking it for granted. Actually visit the support pages for the manufacturer or software developer to check directly.

AppleInsider has repeatedly advised its readers to regularly update their devices for security-related reasons. While we frame it as a way to secure your Apple devices, the same advice applies to the rest of your hardware ecosystem.

It's always better to be proactive and take the time to secure your data, than to be too late and lose it all.