PHP security issues could also threaten your NAS device, but not all vendors can patch them yet
follow us
Add us as a preferred source on Google
- Critical PHP2Shell Flaws Also Affect Internet-Exposed NAS Devices and PHP-Based Docker Workloads
- Major vendors continue to release patches, leaving some Synology, QNAP, and other systems exposed.
- Researchers urge immediate updates, removal of public exposure and VPN-only remote access
Websites and web servers apparently aren’t the only products affected by the php2shell vulnerability – network attached storage (NAS) devices are also at risk – and to make matters worse, some of the most popular manufacturers have yet to release a patch, despite the flaws being actively abused in the wild.
Research by Apple Insider noted that the flaw also affects software maintained by NAS manufacturers, as well as applications running independently in Docker containers, and that NAS devices that can be accessed over the public Internet are also at risk.
What’s particularly concerning is that some of the biggest NAS manufacturers have said they are working on a solution, but there is still work to be done. Synology, for example, published a new security advisory saying that PHP versions 7.3 – 8.4, Mail Station and Synology Calendar are affected and added that it released updated PHP packages to address the flaws. Those running Synology NAS products should head to the company’s Package Center, download the file, and check for updated PHP 8.2 and PHP 8.4 packages.
Latest videos ofTechnologyRadar
Double jeopardy
The company also emphasized that there is a difference between installed PHP packages and PHP components within the DiskStation manager, adding that its built-in PHP is not exposed to the public Internet, so it is most likely not at risk.
Another major NAS manufacturer, QNAP, confirmed a wide range of affected products, including QTS 5.2.11 and earlier, QTS 6.1.9, QuTS hero and QuTScloud, and Note Station 3. It said it was currently working on a fix, but did not give a timeline for when the patch might be available. So far, there is no evidence of savage attacks, but the company recommends removing devices from the open Internet, disabling unnecessary port forwarding, UPnP and remote access services.
Other manufacturers are also currently working on a solution, including TerraMaster, Ugreen, and Asustor, Apple Insider discovered. “NAS owners should check their manufacturer’s security advisories and available updates for their specific models,” the post said.
For NAS owners, the risk is twofold, as PHP is found in both the operating system and Docker containers.
Those running PHP-based services on Docker should check to see if their container images are running affected versions of PHP and update them as soon as possible.
There is also the issue of running older devices that have reached end of life and as such are no longer supported by patches. These, security experts agree, should be removed from public access. Unsolicited incoming connections should be blocked and the device should be kept accessible only locally. Remote access should be achieved over a secure VPN, rather than forwarding the NAS management ports.
P2PShell?
PHP2Shell is the name of a pair of vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that were recently discovered in the PHP programming language. They are considered critical and allow malicious actors to take over websites, steal data, deploy malware, and more. However, the story that until now has revolved around Internet sites and web applications is now also expanding to NAS devices.
PHP2Shell is shaping up to be the biggest, and possibly longest, security incident of the year, possibly rivaled only by the Spectre/Meltdown flaws from eight years ago.
The pair of vulnerabilities, both critical in severity and both allowing remote code execution, affect the vast majority of websites and web applications that exist today.
According to Amazon, knowledge of the flaws was leaked four days before the patches were released, and the number of exploit attempts rose from a few hundred 10 hours before release to millions today.
However, most of these attempts appear to have failed. Analysis is being done on why this is the case, and some researchers think that code execution needs to surpass ASLR, which is a difficult thing to do remotely. However, the entry appears to be just a matter of time, which is why the security community is urging manufacturers to release a fix as soon as possible and owners to apply it without delay.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment