Synology Issues Urgent Update Warning Over Critical PHP2Shell Security Flaws

Synology NAS owners running affected applications are being urged to install security updates immediately, after the company confirmed exposure to critical vulnerabilities that allow remote code execution.

The warning concerns PHP2Shell , two flaws tracked as CVE-2026-109618 and CVE-2026-109619 , with Synology rating both critical in its published security advisory.

For households and businesses using network storage to host applications, the immediate task is to check installed packages and apply the relevant fixes through Package Center.

Synology says the affected applications are Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress, with exposure limited to systems running certain PHP-dependent packages.

The company distinguishes the third-party IDrive package from its own Synology Drive service, which it says is unaffected by PHP2Shell.

The broader PHP vulnerabilities can, under certain conditions, allow attackers to execute code without logging in, according to the United Kingdom’s National Cyber Security Centre.

Its guidance prioritises internet-facing systems for updates, making NAS applications accessible from outside the or office a particular concern for owners assessing their exposure

Synology expanded its response in an October 28 statement, confirming PHP updates for DSM 7.4 and DSM 7.3, alongside end-of-life versions DSM 7.2, 7.1 and 7.0.

A DSM 6.2 patch was scheduled for October 29, although the statement describes that release as planned rather than confirming it has become available.

Owners using versions earlier than DSM 6.2 are advised to temporarily disable affected packages before moving to a supported DSM version.

Users should also check individual package requirements, because Synology’s advisory identifies separate fixed releases for Calendar and MailStation alongside the PHP updates.

The advisory lists Calendar version 3.0.4-21435 or later and MailStation version 30000002.3.19-20333 or later, while warning that PHP 7.3 will receive no fix.

Synology says packages dependent on PHP restart automatically after the PHP update, but its accompanying instructions identify MailStation as requiring a separate manual update through Package Center.

The company also assessed DSM’s internal PHP component, saying it has no externally accessible modules and presents minimal risk, with a fix planned for a later DSM release.

That assessment applies to the internal component, while owners running affected applications still need to follow the package update instructions relevant to their systems.

The NCSC also advises checking potentially exposed systems for evidence of compromise where updates or mitigations could not be applied promptly, including looking for attacker-installed backdoors.