Back Chosun

PHP Vulnerability Found in Synology NAS Devices, KISA Advises Immediate Patch

Chosun • October 30, 2026

A PHP security vulnerability that has recently been spreading has been discovered in network-attached storage (NAS) devices used to store various files. The Korea Internet & Security Agency (KISA) has recommended applying security patches. PHP is a widely used programming language for website development and operation.

According to the security industry on October 30, Taiwanese NAS manufacturer Synology recently confirmed that the PHP vulnerability ‘PHP2Shell’ affects some applications running on its products and announced a security update. If hackers exploit PHP2Shell, they can remotely execute malicious code from outside.

A NAS is a device that connects to a network, allowing multiple users to store and data. It is used for personal file storage, management of corporate work materials and customer information, and backup of critical data. If a NAS is attacked, not only can stored files be leaked, but backup data can also be compromised.

KISA has recommended a security update for Synology products. KISA identified two vulnerabilities (CVE-2023-109618 and CVE-2023-109619) occurring in Synology Calendar, MailStation, and PHP, and has advised users of the affected versions to update to the latest version.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP2Shell Vulnerabilities in Synology NAS Devices Prompt Urgent Updates Synology has issued urgent security updates for critical vulnerabilities in its NAS devices, identified as PHP2Shell, affecting multiple PHP-dependent applications. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote code execution and have been confirmed to be. Affected applications include Calendar, IDrive, Joomla, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress. The US cybersecurity agency CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog due to. Synology has released patches for several versions of DiskStation Manager (DSM), including end-of-life versions, urging users to update immediately. Users running versions prior to DSM 6.2 are advised to disable affected packages temporarily. The internal PHP component of DSM is considered low risk as it has no external exposure. Immediate action is required to mitigate potential data breaches. 7 sources 73

Extracted Entities

PHP Vulnerability Found in Synology NAS Devices, KISA Advises Immediate Patch

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

CVEs (2)

CWE Weaknesses (1)

Tools (1)