Critical PHP2Shell flaws now hit internet-facing NAS devices as Synology, QNAP and others work on patches

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are rated critical and allow remote code execution, giving attackers a route to take over systems, steal data and deploy malware. The affected code spans PHP versions 7.3 to 8.4. In addition to websites and web applications, the flaws reach software maintained by NAS vendors and PHP-based applications running inside Docker containers, which means owners face exposure through both the device operating system and any container images they run.

Synology published a security advisory stating that PHP versions 7.3 through 8.4, Mail Station and Synology Calendar are affected, and said it has released updated PHP packages. Owners of Synology NAS products were directed to the company's Package Center to download the updated PHP 8.2 and PHP 8.4 packages. The company drew a distinction between installed PHP packages and the PHP components inside DiskStation Manager, saying its built-in PHP is not exposed to the public internet and is therefore most likely not at risk.

QNAP confirmed a wider list of affected products, including QTS 5.2.11 and older, QTS 6.1.9, QuTS hero, QuTScloud and Note Station 3. It said a fix is in progress but gave no timetable for release. QNAP said it has seen no evidence of attacks in the wild against its devices, while recommending that users take the equipment off the open internet and disable unnecessary port forwarding, UPnP and remote-access services.

TerraMaster, Ugreen and Asustor are also working on fixes, Apple Insider found. Owners were advised to check their manufacturer's security notices and the updates available for their specific models.

Devices that have reached end-of-life and no longer receive patches cannot be fixed, and security specialists recommend removing them from public access altogether: block unsolicited inbound connections, keep the device reachable only on the local network, and use a secure VPN for remote access instead of forwarding NAS management ports.

Attempts to exploit the flaws have risen sharply. Amazon said knowledge of the vulnerabilities leaked four days before patches were published, and that exploitation attempts went from a few hundred ten hours before publication to millions by the time the flaws became public. Most of those attempts appear to have been unsuccessful, and analysis of why is continuing; some researchers believe successful code execution requires getting past address space layout randomization, which is difficult to achieve remotely. The security community has urged manufacturers to ship fixes quickly and owners to install them without delay.