Skip to content
Critical PHP2Shell Vulnerabilities Disclosed for Synology NAS Devices

Critical PHP2Shell Vulnerabilities Disclosed for Synology NAS Devices

First seen 29 Oct 2026, 17:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 19:16 UTC
  • •Two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed for Synology NAS.
  • •Patches available for multiple DSM versions, including some that are end-of-life.
  • •Active exploitation confirmed; users must update affected applications immediately.

Synology has released critical security updates for vulnerabilities in PHP-dependent applications on its NAS devices, identified as CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.8. These vulnerabilities could allow remote code execution under certain configurations, affecting applications like WordPress, Joomla, and phpMyAdmin. The issues were disclosed on October 21, 2026, and have been added to the CISA KEV list due to confirmed. Synology has issued patches for several versions of DiskStation Manager (DSM), including those that have reached end of life. Users are advised to check for affected applications and apply the necessary updates immediately. The built-in PHP component of DSM is considered to have a low risk of external exploitation. However, vulnerable applications still pose a significant risk, especially if accessible over the internet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Synology disclosed critical vulnerabilities affecting PHP applications on NAS devices.
Digitalreviews
2026-10-26
CVE added to CISA KEV list
CISA confirmed active exploitation of the vulnerabilities, adding them to the KEV catalog.
Digitalreviews
2026-10-28
Synology releases security updates
Patches for affected applications and DSM versions were made available, including for end-of-life versions.
Digitalreviews

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

Which applications are affected?
Affected applications include WordPress, Joomla, phpMyAdmin, Synology Calendar, and Mail Station.
What should I do if I use Synology NAS?
Check for installed affected applications and apply the latest security updates immediately.
Is there a risk if I don't update?
Yes, failing to update could expose your NAS to remote code execution attacks.