Two PHP flaws rated 9.2 on CVSS 4.0 also reach the NAS appliances offices rely on for backup. Synology has shipped updates; QNAP has yet to name a fixed version.
When the PHP2Shell flaws were disclosed earlier this month, the conversation was about web servers. A week on, the second half of the picture has emerged: the same flaws reach the NAS appliances that offices use for backup and file sharing, and one of the major vendors has still not shipped a fix.
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS 4.0 scale. Each can be triggered before application-level authentication, which means a login prompt on the device's interface offers no protection by itself. The PHP project released fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
The gap between vendors
The complication is that NAS vendors bundle PHP inside their own operating systems. PHP being patched does not mean the appliance is patched.
- Synology published advisory SA-26:14 on 22 October and began distributing updates for the affected PHP packages, Mail Station and Synology Calendar through Package Center. PHP 7.3 gets no fix because it has reached end of life.
- QNAP published QSA-26-18 on 22 October, listing QTS, QuTS hero, QuTScloud and applications including Note Station 3, QNE and QVR Surveillance as affected. At the time of writing, the fixed-version field still reads "to be announced". Download Station and PHP Extensions, whose support ended on 30 September, will not be fixed at all.
- Asustor says work on ADM 4.1-5.1 is ongoing, and TerraMaster has said it is investigating.
QNAP states it has received no reports of attacks against its products. Amazon's MadPot honeypot network, however, observed the first PHP2Shell exploitation attempts on 17 October, and watchTowr reported active attempt traffic after the patches landed, though it confirmed no successful compromise.
Why this matters for smaller businesses
In most offices the NAS is the quietest machine on the network. It gets installed, the backup job is configured, and nobody opens its interface again for years. Yet that same box usually holds accounting backups, project files, contracts and HR records. It is precisely the target ransomware crews prioritise: an attacker who can encrypt the backup holds every card in the negotiation.
The second exposure is port forwarding set up for remote access. A rule opened so that staff can reach files from home turns the appliance into an internet-facing system — and that is exactly the scenario an unauthenticated flaw exploits.
What we recommend at Kamer Bilişim
- Take the NAS off the internet. Disable port forwarding and UPnP on the router, and switch off cloud relay services such as myQNAPcloud Link. Where remote access is genuinely needed, route it through a VPN. This is QNAP's own recommendation while a fix is pending.
- If you run Synology, update today. Install the PHP package updates from Package Center, along with Mail Station and Calendar if present. Remove PHP 7.3 if it is still installed — no fix is coming for it.
- Do not keep the only copy of your backup on the NAS. At least one copy should sit outside the appliance and outside the network: an external disk, tape, or cloud storage reached with separate credentials. A single backup location on the network is a single point of failure.
If you would like help checking whether your NAS and backup infrastructure are exposed to these flaws, and reviewing which of your services face the internet, reach us through our contact page. We work on site across the Anatolian side of Istanbul and provide remote support elsewhere.
Source: QNAP Security Advisory QSA-26-18 (22 October 2026), Synology SA-26:14, Notebookcheck and XenoSpectrum (23 October 2026)
Source: QNAP Security Advisory QSA-26-18