PHP2Shell flaws put NAS devices at risk as vendors prepare patches

The PHP2Shell vulnerability pair may affect network-attached storage (NAS) devices as well as websites and web apps, according to TechRadar, citing research by Apple Insider. Devices reachable from the public internet may be at risk, and the flaws have been actively exploited in the wild. The source also says there is no evidence of in-the-wild attacks against QNAP products.

Synology says PHP versions 7.3–8.4, Mail Station and Synology Calendar are affected. It has released updated PHP packages and advises users to check Package Center for PHP 8.2 and PHP 8.4 updates. The company says its built-in PHP component in DiskStation Manager is not exposed to the public internet and is most likely not at risk.

QNAP lists QTS 5.2.11 and older, QTS 6.1.9, QuTS hero, QuTScloud and Note Station 3 among affected products. It is working on a fix but gave no release timeline. TerraMaster, Ugreen and Asustor are also reported to be preparing fixes.

The flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution. The report says PHP in Docker containers may also be affected, and urges NAS owners to check vendor advisories and available updates. It also relays recommendations to limit public access and disable unnecessary remote-access features.