Back Mezha

Ransomware hits internet-exposed Synology DS918+ left without security patches for 18 months

Mezha • October 29, 2026

A ransomware attack encrypted files on a Synology DS918+, but its owner says a 3-2-1 backup setup appears to have prevented data loss.

user NakamuraHwang investigated the attack by connecting the NAS disks to a Proxmox machine. The logs and system files suggested the attackers may have exploited CVE-2024-10441, a remote code execution flaw disclosed 18 months earlier. Synology’s DSM operating system uses mdraid, allowing the disks to be mounted on another machine.

This is reported by Tom’s Hardware .

The NAS had its web interface exposed to the internet and had gone roughly 18 months without security patches. Exposing a device directly to the internet without an added layer of protection, such as a VPN or SSH tunnel, is generally discouraged. Tailscale offers a VPN service with a free plan that the article says covers most setups.

Synology had issued an advisory the vulnerability, but its update process may have contributed to the lapse. Commenters on and other forums said the interface can report a device as up to date even when critical security updates still need to be installed manually. The DSM manual indicates that automatic updates are available on devices from 2025 onward, apparently meaning older models may need to be configured for them.

Synology also apparently lacks a direct way to alert customers to critical vulnerabilities, such as email notifications. The company still sells smaller devices for ordinary users, who may not follow security bulletins. Updates to packages, including the patch for the PHP2Shell vulnerability, must also be installed separately.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Attack on Exposed Synology NAS Due to Outdated Security A ransomware attack has encrypted files on a Synology DS918+ NAS owned by user NakamuraHwang, who had not updated the device for 18 months. The NAS was exposed to the internet, making it vulnerable to exploitation. Investigations indicated that the attackers likely exploited the CVE-2024-10441 remote code execution vulnerability, disclosed in March 2025. Hwang's 3-2-1 backup strategy helped prevent data loss. The Synology DSM operating system allows disks to be mounted on other systems, facilitating forensic analysis. While Synology issued an advisory regarding the vulnerability, the update process may have contributed to the incident, as critical updates required manual installation. The user was unaware of the need for these updates due to the misleading interface reporting the device as up to date. Synology lacks a direct notification system for critical vulnerabilities, which could leave ordinary users uninformed about security risks. 2 sources 55

Extracted Entities

Ransomware hits internet-exposed Synology DS918+ left without security patches for 18 months

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Tools (1)