Synology patches 10 PHP2Shell packages

What Synology fixed

Synology published Synology-SA-26:14 for the PHP2Shell vulnerabilities on 22 October 2026 and expanded the update coverage through 29 October. The advisory is rated Critical and marked Resolved.

It covers both CVE-2026-109618 and CVE-2026-109619 and lists PHP 7.3, 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4, Mail Station and Synology Calendar as affected products. Fixed packages include PHP 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051.

PHP 7.3 has no fix. Synology describes it as end-of-life; the practical path is to remove or replace the dependency.

Which packages are exposed

The advisory’s product table is narrower than the set of packages that can carry PHP. Synology’s press release names ten PHP-dependent packages affected in practice:

• Calendar
• IDrive
• Joomla
• KodExplorer
• MailStation
• MediaWiki
• phpMyAdmin
• vtigerCRM
• Web Station
• WordPress

A NAS is not a normal web host, but Web Station and WordPress can be published to the internet. phpMyAdmin and other administrative tools are also high-value targets when exposed.

Synology says DSM’s built-in PHP component for internal system use is not externally accessible by design, so it assesses that component’s risk as minimal. The exposure is the installed package, not the DSM core.

Which DSM versions

Synology released PHP updates for DSM 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2. Support for DSM 7.0 and 7.1 was added on 28 October, and DSM 6.2 on 29 October.

Dependent packages restart automatically after the PHP update, except MailStation, which requires a manual update. For DSM versions earlier than 6.2, Synology recommends temporarily disabling affected packages rather than leaving them exposed.

What to do

1. Open Package Center and update PHP and every affected package.
2. Manually update MailStation; do not assume the automatic restart covered it.
3. Remove PHP 7.3 dependencies or migrate them; there is no fixed package.
4. Stop publishing Web Station, WordPress, phpMyAdmin and other package interfaces to the internet unless they are required.
5. Check logs and file changes for signs of compromise before treating the device as clean.

The patch tracker covers the upstream PHP releases. The verification guide covers runtime checks; on a NAS, the package version and the process serving the package both matter.

Do not conflate this with the NAS ransomware reports

Reports in late October described a separate LOCK3D/C3RB3R ransomware campaign against outdated Synology NAS devices. The reporting reviewed here does not establish PHP2Shell as the entry point for those infections. Treat the ransomware reports as a separate investigation; do not use them as proof that every infected NAS was compromised through these two CVEs.

The confirmed facts are narrower: Synology shipped fixes for PHP2Shell in its packages, and some of those packages can be internet-facing.