PHP2Shell reaches the NAS: what the PHP flaws mean for Synology, QNAP, NetApp, and your file shares

PHP2Shell is a pair of critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on any server that handles web requests with PHP. The PHP project shipped fixes on October 21, 2026, a day earlier than planned because the CVE identifiers leaked. Amazon Threat Intelligence had already logged an exploitation attempt on October 17.

Most coverage has focused on websites. The quieter exposure is file storage. Synology and QNAP NAS operating systems bundle PHP for web interfaces, photo galleries, website hosting, and apps, and NetApp says ONTAP 9 is affected too. On those systems, a web runtime CVE is also a storage CVE.

According to public reporting from Tenable and Patchstack, both flaws carry a CVSS v4.0 score of 9.2 and are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. One comes from how PHP cleans up after running out of memory partway through a request. The other is a use-after-free, where state left behind by one request is picked up by the next. The PHP Foundation credited Calif, OpenAI, and Wiz, among others, for the research, and government services in the Netherlands and elsewhere went offline while operators patched.

Yes for QNAP, yes for Synology systems that serve PHP through Web Station, and yes for NetApp ONTAP 9, which is affected by one of the two flaws. TrueNAS says its platform is not affected, though PHP apps installed from its catalog are. RackTop BrickStor SP does not include PHP. The table shows each platform’s status as of October 22, 2026, and what each vendor has said follows below it.

QNAP answered first. Its advisory QSA-26-18, published October 22, 2026, lists QTS, QuTS hero, QuTScloud, and several applications as affected, with fixed versions to be announced, and says QNAP has not received reports of exploitation targeting its products. One line in its interim guidance deserves more attention than it will get: restricting access to the local network does not protect against attacks from local devices that are already compromised. That is a storage vendor saying, in its own advisory, that the perimeter is not enough.

Synology’s position is less settled. As of October 22, its advisory page listed no PHP2Shell entry, and Synology states that it does not announce vulnerabilities until fixes are available. Web Station, which hosts PHP websites and apps on DSM, is the most visible exposure. nxtbit reported that Synology’s newest PHP 8.4 package was 8.4.19, short of the fixed 8.4.27, and both nxtbit and Marius Hosting recommend disabling session.upload_progress in each Web Station PHP profile as a stopgap. Tenable and Amazon both stress that interim settings reduce risk without making an installation safe.

Enterprise arrays are not exempt. NetApp’s interim advisory NTAP-20261021-0021, last updated October 21, 2026, lists ONTAP 9 as affected by CVE-2026-109618, the out-of-memory flaw, but not by CVE-2026-109619. NetApp says an unauthenticated attacker could gain access as the www user but would be restricted to the PHP jail, which limits the scope. No patched ONTAP release was listed. The workarounds are to disable external web services, which turns off System Manager, REST, and ZAPI; to enable SAML so Apache requires authentication before invoking PHP; or to disable the System Manager and SAML web services alone. NetApp notes that a SAML-authenticated attacker could still exploit the flaw.

TrueNAS lands on the other side of the line. Its impact statement says the TrueNAS platform does not ship or use PHP, so SCALE, CORE, and TrueCommand are not affected. PHP-based apps installed from its catalog, such as Nextcloud, carry their own PHP and need their own updates.

For Synology owners this is the second critical round in five weeks. On September 18, 2026, Synology advisory SA-26:13 fixed eight DSM vulnerabilities, two rated CVSS 9.8 (CVE-2026-13684 and CVE-2026-13639) that let an unauthenticated attacker read or write arbitrary files, according to the advisory and reporting from heise. And NAS devices have been here before: in 2022, DeadBolt ransomware encrypted internet-exposed QNAP devices in repeated waves, according to reporting from TechTarget and The Hacker News.

Amazon said it is unclear how the actor behind the October 17 attempt obtained exploit details early. Public proofs of concept appeared within hours of the release, and watchTowr reported exploitation in its honeypot network on October 21. For any reachable PHP system, the exposure window opened before the advisory did.

So after patching, a security team has a second question to answer: did anyone get in first? Most storage platforms cannot answer it. Web server logs, where they are kept, show requests to the PHP layer. They do not show what an attacker did with the access afterward: which shares were browsed, which files were opened, what was copied out. Tenable lists memory disclosure as a confirmed impact of CVE-2026-109619, and Patchstack warns that PHP worker memory can hold passwords, tokens, and API keys. An attacker who harvests credentials that way comes back later as an ordinary authenticated user, and from then on looks like everyone else on the file share.

This is the job of User Behavior Auditing. BrickStor SP records every file operation by user, session, and client in an immutable audit trail kept inside the storage operating system, where an intruder cannot switch it off or edit it. When a vulnerability lands, the team reviews the exposure window, October 17 onward in this case, and answers from evidence: did any account read at unusual breadth, reach into shares outside its normal pattern, or connect from a client it has never used? For any account in question, it can list every file that account read before the patch went on. The example UB report below shows what that record looks like.

Active Defense applies the same behavioral view live, which is what NAS ransomware protection has to mean when nobody knows the entry point yet. It needs no CVE number or signature. A session that starts reading or rewriting files in bulk is terminated in under a second, whether it came in through PHP2Shell, a phished password, or next quarter’s flaw. Without that record and that response, a team is left to guess, and guessing tends to end in a worst-case breach disclosure.

Synology and QNAP build capable products for what they were designed to do, and both offer snapshots that are worth turning on today. Their design goal is a NAS that also serves media, hosts websites, and runs apps. That breadth is useful at home and in a small office. In an enterprise holding regulated or mission data, every bundled service is one more runtime to patch on someone else’s schedule, and snapshots alone cannot tell you what was read before anything was encrypted.

NetApp’s case shows the problem is not limited to consumer devices. When an enterprise array serves its management interface through PHP, the interim fix for a PHP flaw is to switch that interface off or put another authentication layer in front of it. BrickStor SP does not include PHP, so this week its owners faced no such trade.

There will always be a next CVE: last month it was DSM, this week it is PHP. An enterprise file platform should assume one layer will fail and keep the data safe anyway. Cyberstorage is the practice of building each of the layers below into the storage system that serves the files, so data storage security does not depend on the perimeter holding.

If you run Synology or QNAP devices, take them off the internet, move remote access behind a VPN, and stop Web Station sites and PHP-based apps you do not need. Apply the vendors’ PHP fixes the day they ship, apply Synology SA-26:13 if you have not, and review logs from October 17 onward for unusual multipart uploads, memory-limit errors, and unexplained HTTP 500 responses. If you run NetApp ONTAP 9, apply one of NetApp’s workarounds until a fixed release ships and watch the advisory for updates. Then rotate any credentials those systems held. If they store business, regulated, or mission data, this is a good moment to ask whether a consumer NAS belongs in that role.

RackTop’s free Cyber Recovery Readiness Assessment is a 32-question scored review of how ready you are to recover from ransomware, insider threats, data theft, and infrastructure compromise. Take it to see which of the layers above you have today, or request a demo to watch Active Defense stop a live ransomware attack on BrickStor SP.