Synology Confirms Critical PHP2Shell Vulnerabilities in NAS Applications
Synology has confirmed critical PHP2Shell vulnerabilities affecting several applications on its NAS devices. Security updates have been released, and exploitation attempts have been observed.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
Synology confirmed critical vulnerabilities in PHP-dependent applications on NAS devices.
Who is affected
DiskStation Manager, Calendar, IDrive, Joomla, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress.
Exploited
Exploitation confirmed.
What to do
Check Package Center for updates; disable affected packages on older DSM versions.
Synology has confirmed the presence of critical PHP2Shell vulnerabilities affecting a range of PHP-dependent applications on its NAS devices. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS 3.1 severity score of 9.8.
The affected applications include Calendar, IDrive, Joomla, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress. Synology has released security updates for multiple versions of DiskStation Manager (DSM), including end-of-life versions, to address these vulnerabilities.
A patch for DSM 6.2 was scheduled for release on October 29, 2026. Synology's Product Security Incident Response Team (PSIRT) has indicated that these vulnerabilities allow remote code execution, and the US cybersecurity agency CISA has added them to its Known Exploited Vulnerabilities catalog.
Synology advises users running affected applications to check the Package Center and install the latest available PHP security updates. For systems running versions prior to DSM 6.2, Synology recommends temporarily disabling affected packages.
The internal PHP component of DSM is considered low risk due to its lack of external exposure. However, the vulnerabilities have gained attention due to observed exploitation attempts before their public disclosure on October 21.
