PHP2Shell flaws hit NAS devices: Synology patched, QNAP still waiting

Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on internet-exposed NAS devices. PHP fixes shipped October 21 for versions 8.2–8.5; Synology has released updated packages, while QNAP confirmed affected QTS and QuTS versions but has not set a patch date. TerraMaster, Ugreen and Asustor are still assessing the threat.

• CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution
• Amazon spotted an exploit attempt on October 17, four days before disclosure
• Synology patched PHP 7.3–8.4, Mail Station and Calendar; QNAP has no fix yet
• PHP inside Docker containers must be updated separately from NAS firmware