PHP security fixes released on October 21, 2026 are now reaching the storage aisle. According to TechRadar, two critical flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution, and several NAS makers have either confirmed affected components or said they are working on fixes. The pair is referred to as PHP2Shell.
The vendor picture is uneven. Synology shipped updated PHP packages through Package Center. QNAP confirmed a list of affected products but gave no patch timeline. TerraMaster said on October 22 that it was investigating and testing the issue. TechRadar also reported that Ugreen and Asustor are working on fixes, with no dates attached.
That gap matters because attackers rarely wait for slow patch cycles. Our earlier coverage of PHP2Shell attacks that began before the flaw was disclosed showed how short the window can be. This story tracks what each NAS vendor has said so far, what remains unconfirmed, and what owners of these boxes can do today.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What PHP Fixed on October 21
The PHP project released security fixes on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619. The patched builds are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Each one covers a separate supported branch, so admins running any of those four lines have a clear upgrade target.
Both vulnerabilities carry a critical rating, and the reporting describes the impact as unauthenticated remote code execution. In plain terms, a remote attacker does not need a username or password to run commands on a vulnerable server. The attacker only needs to reach a web-facing PHP component that accepts the malicious input.
The release list tells us something else. PHP 8.2.35 sits at the older end of the supported range, yet it still received a fix. Many appliance vendors do not track the newest PHP branch at all. They freeze a runtime at the time of a firmware build and carry it for years. That habit is the root of the NAS problem described below.
| PHP branch | Fixed release | Fix date |
|---|---|---|
| PHP 8.5 | 8.5.12 | October 21, 2026 |
| PHP 8.4 | 8.4.27 | October 21, 2026 |
| PHP 8.3 | 8.3.36 | October 21, 2026 |
| PHP 8.2 | 8.2.35 | October 21, 2026 |
| CVE identifiers | CVE-2026-109618, CVE-2026-109619 | Reported as critical |
Which NAS Vendors Are Affected
TechRadar’s roundup names five NAS brands. Synology and QNAP have published specifics. TerraMaster, Ugreen and Asustor have said less. The detail level differs sharply between them, and that difference shapes how much risk each owner group carries right now.
Synology: Fixed Packages Are Live
Synology said PHP versions 7.3–8.4, Mail Station and Synology Calendar are affected. The company released updated PHP packages that address the flaws, and they are available through Package Center. For most Synology owners the action is simple: open Package Center, check for updates, and install what it offers.
The affected range is wide. Spanning PHP 7.3 to 8.4 means Synology maintains several runtime lines side by side, and the fix had to land across all of them. Delivering the fix through Package Center rather than a full firmware update likely let the company move faster.
QNAP: Confirmed, but No Timeline
QNAP confirmed that QTS 5.2.11 and older, QTS 6.1.9, QuTS hero, QuTScloud and Note Station 3 are affected. The company said it is working on a fix but did not provide a patch-release timeline. That leaves a long list of products with an acknowledged problem and no date for relief.
The list covers both operating system families QNAP sells, plus its cloud-hosted variant and a note-taking application. For owners, the practical reading is that the exposure lives in the platform itself and in at least one add-on app. Neither can be waved off as a corner case.
TerraMaster, Ugreen and Asustor: Fixes Still in Progress
TerraMaster said on October 22 that its team was investigating and testing the issue while working toward a resolution. As of the TechRadar report, it had not released a patch. The company did not publish a list of affected models in the material we reviewed, so owners cannot yet tell which product lines are in scope.
Ugreen and Asustor were reported as working on fixes. No patch date for either has been confirmed. That silence is not unusual for a young vulnerability, but it is the part of this story that owners should watch most closely. A vendor that says it is working on a fix has told you very little about when you can stop worrying.
Here is the scoreboard as of October 24, based on the reporting.
| Vendor | Status reported | Patch available | Timeline given |
|---|---|---|---|
| Synology | Confirmed PHP 7.3–8.4, Mail Station, Synology Calendar affected | Yes, via Package Center | Not needed |
| QNAP | Confirmed QTS, QuTS hero, QuTScloud, Note Station 3 affected | No | None |
| TerraMaster | Investigating and testing, statement dated October 22 | No | None |
| Ugreen | Reported as working on a fix | No | None |
| Asustor | Reported as working on a fix | No | None |
| PHP project | Fixed in four supported branches | Yes, since October 21 | Not needed |
Why a PHP Bug Becomes a NAS Problem
A NAS looks like a plain storage box, but it runs a full web stack. The management interface, photo galleries, mail tools, calendars and note apps are all web applications, and many rely on a PHP runtime. When PHP has a critical flaw, every component that parses untrusted input through it inherits the risk.
Synology’s own advisory language shows the pattern. It lists the PHP runtime itself plus two applications, Mail Station and Synology Calendar. QNAP’s list works the same way, pairing the operating systems with Note Station 3. The runtime is the shared foundation and the apps are the doors into it.
Websites face the same math. Our look at how AI found the PHP2Shell flaw in code that runs across much of the web covers the server side. A NAS differs in one important way. Website owners can redeploy a container or swap a hosting plan in an afternoon. NAS owners wait for the vendor, because the runtime ships inside firmware and packages the user does not control.
There is also a data-gravity effect. A compromised web server is bad. A compromised NAS often holds family photos, tax records, business files and the backups of other machines. An attacker who lands code execution there reaches the most valuable material in a home or small office without touching anything else.
What Unauthenticated Remote Code Execution Means for Storage
Security teams treat unauthenticated remote code execution as the top tier of severity. Two properties drive that rating. The attacker needs no credentials, and the outcome is the ability to run chosen commands on the target. Together they remove most of the friction that normally slows an attack.
On a NAS, code execution can lead to several outcomes. An attacker could read or copy stored files, encrypt volumes and demand payment, plant a persistent foothold, or use the device as a staging point toward other machines on the network. Which of those happen depends on the specific product, the configuration and the attacker’s goals. The reporting does not claim any of them has occurred on these brands.
Exposure is the other half of the equation. A box that sits behind a firewall with no forwarded ports is much harder to reach than one whose web interface is open to the internet. Public web ports draw attention fast. We covered that thread in our report on the NSA warning on the PHP flaw as four nations pulled sites, and the same logic applies to anything with a public web port.
What Is Confirmed and What Is Not
Precision matters here, because headlines compress a messy situation. TechRadar’s framing suggests PHP bugs could threaten NAS devices. The reporting backs that up for products the vendors named. It does not establish that every listed product is exploitable in every configuration.
- Confirmed: PHP released fixes on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Confirmed: Synology named PHP 7.3–8.4, Mail Station and Synology Calendar as affected, and released updated packages.
- Confirmed: QNAP named QTS 5.2.11 and older, QTS 6.1.9, QuTS hero, QuTScloud and Note Station 3, and said a fix is in progress.
- Confirmed: TerraMaster said on October 22 it was investigating and testing, and had not released a patch.
- Reported: Ugreen and Asustor are working on fixes.
- Not confirmed: exploitability of every listed product or setup, and any patch date from QNAP, TerraMaster, Ugreen or Asustor.
We also have no confirmed count of compromised NAS devices, and no named campaign tied to these brands in the sources we reviewed. Treat any claim of mass NAS infection from this specific flaw as unverified until a vendor or a named security team publishes evidence.
The Patch Gap: Why Vendors Lag Upstream
The PHP project fixed the flaws on October 21. By October 24, only one of the five NAS brands in the story had a published fix. That three-day spread is short in absolute terms, yet it exposes a structural problem with appliance security.
Upstream projects patch source code. Appliance vendors then have to pull that fix, rebuild their own packages, test them against dozens of hardware models and several firmware lines, and push the result to customers. Each step takes time, and the work multiplies when a vendor supports older products. QNAP’s list shows the scale, with QTS 5.2.11 and older sitting alongside QTS 6.1.9 and QuTS hero.
Synology’s quick turnaround likely reflects packaging choices. Because PHP ships as a package that Package Center can update independently, the company did not have to wait for a monolithic firmware release. That modular design is a real security advantage, and rivals that bundle the runtime deeper in the base system pay for it in delay.
Enterprise software teams know this pattern well. Our analysis of the Ivanti patch gap and the end of life for 22.x shows what happens when old branches outlive their support window. NAS owners face a consumer-scale version of the same trap.
Vendor Comparison: Who Gives Owners the Most Clarity
Judged only on what the reporting shows, Synology leads. It named the affected components, shipped the fix and told owners where to find it. QNAP ranks second on transparency, since it published a detailed product list, but it loses points for the missing timeline.
TerraMaster’s October 22 statement shows engagement, though it gave owners no model list and no date. Ugreen and Asustor sit at the bottom of the clarity ranking for now, because the reporting records intent without detail. That ranking is a snapshot. Any of the three could publish a full advisory tomorrow and jump the order.
| Vendor | Named affected products | Shipped a fix | Gave a date | Clarity rank |
|---|---|---|---|---|
| Synology | Yes | Yes | Not needed | 1 |
| QNAP | Yes, five items | No | No | 2 |
| TerraMaster | Not in reporting | No | No | 3 |
| Ugreen | Not in reporting | No | No | 4 (tie) |
| Asustor | Not in reporting | No | No | 4 (tie) |
Historical Context: NAS Boxes as Repeat Targets
NAS devices have long drawn attention from criminals for the same reasons they appeal to buyers. They run around the clock, hold concentrated data, sit on home and office networks, and often get updated less carefully than laptops or phones. Security researchers have warned about that profile for years.
PHP itself has a long record as a frequent source of critical web vulnerabilities, partly because it powers so much of the web. A flaw in the language runtime reaches every product built on it, from shared hosting plans to storage firmware. PHP2Shell fits that history. The new factor in 2026 is how fast the story moved from disclosure to government warnings to hardware vendors.
The lesson from earlier appliance incidents is consistent. The risky period is the stretch between public disclosure and a user actually installing the update. Vendors control the first half of that gap, and owners control the second. In this case, Synology owners can close it today, while owners of the other brands can only reduce their exposure.
Market Impact for NAS Buyers
The immediate commercial effect will be on trust, not on sales figures. We have no reported data on shipments or price changes tied to PHP2Shell, and we will not guess at any. What we can say is that shoppers who weigh security responsiveness now have fresh evidence to compare.
Brands that shipped a fix quickly may use it in their marketing. Brands that did not could face questions in forums and review sections. Vendors with shorter NAS track records have the most to prove against established players. Our comparison of the Beelink ME Pro, Ugreen and Synology as mini PC NAS options shows how buyers weigh several of these names against each other.
Buyers who want to follow the wider storage and hardware market can browse our hardware coverage for pricing and product news. For this story, the buying advice is short. Ask any vendor you are considering how it ships security fixes, how fast it moved on PHP2Shell, and whether the runtime can be updated without a full firmware release.
What NAS Owners Should Do Now
The steps below are general hardening practice and our own analysis, not instructions from any vendor. Follow each vendor’s advisory first, since it knows its own firmware. Where no patch exists, the goal is to shrink the number of ways an attacker can reach the vulnerable code.
| If you own | Priority action | Backup step |
|---|---|---|
| Synology | Open Package Center and install the updated PHP packages. Check Mail Station and Synology Calendar if installed. | Confirm a recent offline or off-site backup exists |
| QNAP | Watch the vendor advisory for a fix. Consider removing Note Station 3 until one arrives. | Take a fresh snapshot and copy it off the device |
| TerraMaster | Check the vendor’s channels for an advisory and model list. | Keep a copy on a disconnected drive |
| Ugreen | Watch for a firmware or package update. | Keep a copy on a disconnected drive |
| Asustor | Watch for a firmware or package update. | Keep a copy on a disconnected drive |
Across all brands, a few rules apply. Remove any port forwarding that exposes the web interface to the internet. Reach the device through a VPN instead of a public port. Turn off web apps you do not use, because every installed app adds a door. Make sure automatic update checks are on, so a fix lands the day it ships.
Network hygiene helps too. A properly configured router limits what can talk to your NAS from outside, and our guide to router security settings that harden a home network walks through the controls worth changing. Pair that with an offline backup, since a backup that stays connected to the same compromised box offers little protection.
Predictions: What Happens Next
These are our forecasts, built on how similar vendor patch cycles have gone. They are judgment calls, not reported facts, and any could prove wrong.
- Most remaining vendors will ship fixes within weeks. QNAP, TerraMaster, Ugreen and Asustor all say they are working on this, and public pressure tends to compress timelines. We expect at least two of the four to publish patches before mid-November.
- QNAP will publish a timeline soon. Having named five affected items, the company has little reason to stay silent about dates for long.
- Vendors will publish fuller model lists. TerraMaster, Ugreen and Asustor face growing pressure to say exactly which products are in scope.
- Buyer guides will add a patch-speed criterion. Reviewers who once judged NAS boxes on speed and price will start scoring how fast a vendor responds to upstream flaws.
- Modular runtimes will gain favor. Vendors that can update PHP independently of base firmware will push that design as a selling point, and others may copy it.
The Takeaway for Storage Security
PHP2Shell is a reminder that a NAS is a networked computer first and an appliance second. Its security depends on a long chain of software that the owner rarely sees. One broken link, in this case the PHP runtime, can threaten products from several competing brands at once.
As of October 24, owners of Synology devices have a clear path forward. Everyone else is waiting, and the sensible response is to limit exposure, back up offline and watch vendor advisories. We will update this story as QNAP, TerraMaster, Ugreen and Asustor publish details.
FAQ: PHP2Shell and NAS Devices
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. According to TechRadar, they can allow unauthenticated remote code execution. PHP released fixes for them on October 21, 2026.
Which PHP versions fix the flaws?
The fixed releases are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Appliance vendors need to bring those fixes into their own packages, which is why NAS patches arrive at different times.
Is my Synology NAS safe now?
Synology released updated PHP packages through Package Center and said PHP 7.3–8.4, Mail Station and Synology Calendar were affected. Installing the update closes the gap the company described. Check Package Center to confirm you are current.
Which QNAP products are affected?
QNAP confirmed QTS 5.2.11 and older, QTS 6.1.9, QuTS hero, QuTScloud and Note Station 3. The company said it is working on a fix and gave no patch-release timeline.
Have TerraMaster, Ugreen and Asustor released patches?
Not as of the reporting. TerraMaster said on October 22 that it was investigating and testing, and it had not released a patch. Ugreen and Asustor were reported as working on fixes, and no patch date has been confirmed for any of the three.
Is every listed NAS product exploitable?
That is not established. The reporting confirms affected components for products the vendors named, but it does not show that every product or configuration can be exploited. Exposure depends on the device, its settings and whether the vulnerable component is reachable.
What should I do if my vendor has no patch yet?
Cut off internet access to the web interface, use a VPN for remote access, disable unused web apps, keep an offline backup and watch your vendor’s advisory page. These are general precautions, not vendor guidance.
