SearchSubscribe

NewsScams & security

PHP2Shell fixes are out for Synology and QNAP storage boxes

Your web host has probably patched PHP. The storage box in your office is your job. Synology and QNAP have released PHP2Shell fixes, including for older systems.

By Digital Advisors Publisher Bob Jones 4 min read 3 sources

a small Australian back office with a cluttered desk, a wall calendar and a kettle on a filing cabinet, where a halftone network storage box the size of a fridge stands in the corner, its rows of drive bays towering over the desk chair beside it. one drive tray pulled halfway out of the giant storage box is the only full-colour element, purple-blue with the white oval PHP logo on its front; no other words
Illustration: Digital Advisors

Your web host has probably patched PHP by now. The storage box humming in your office cupboard is a different story. Nobody patches that but you.

Network storage boxes, often called NAS drives, run PHP too. Synology and QNAP have now released fixes for PHP2Shell, a pair of critical PHP flaws. We covered them in PHP’s critical fixes are out. Has your website been patched?.

Why your storage box is in the picture

PHP is the software behind a lot of websites. Many NAS boxes also use it to run built-in apps such as web servers, calendars, mail and WordPress.

Both flaws are rated critical. QNAP says both can be triggered before any login to the app takes place.

QNAP says exploitation attempts against PHP have been reported publicly, though it hasn’t had reports of attacks targeting its products.

Synology: it depends on your apps

Synology’s security team says only systems running certain PHP-based packages are affected. These are:

  • Calendar, MailStation and Web Station
  • WordPress, Joomla and MediaWiki
  • phpMyAdmin, KodExplorer and vtigerCRM
  • IDrive, a third-party package

Synology Drive is not affected.

If you use one of those packages, Synology “strongly” advises updating PHP through Package Center immediately. The dependent packages then restart by themselves. MailStation is the exception: it needs its own manual update in Package Center.

Older Synology boxes get fixes too

PHP updates are out for DSM 7.4 and 7.3, plus the end-of-life DSM 7.2. Fixes for DSM 7.0 and 7.1 followed on 28 October, and DSM 6.2 on 29 October.

On anything older than DSM 6.2, the advice is to switch off the affected packages until you upgrade.

DSM itself also contains PHP for internal use. Synology says that copy has no exposed attack surface, rates the risk as minimal and will patch it in a later DSM release.

Synology points to its security advisory, SA-26:14, for further details and the latest updates.

QNAP: update the whole system

On QNAP, the fix comes as a new version of the operating system. These are the main fixed versions in QNAP’s advisory, all built on 23 October:

System Fixed version
QTS 6.1.0 QTS 6.1.0.3656
QTS 5.2.11 and earlier QTS 5.2.11.3661
QuTS hero h6.1.0 QuTS hero h6.1.0.3656
QuTS hero h6.0.x and h5.3.x QuTS hero h6.0.2.3656
QuTS hero h5.2.11 and earlier QuTS hero h5.2.11.3661
QuTScloud c5.2.9 and earlier QuTScloud c5.2.9.3661

To update, go to Control Panel > System > Firmware Update > Live Update and choose Check for Update. Notes Station 3 has its own fix, version 3.9.15, in App Center. The advisory also covers QVR Surveillance and TVR OS.

PHP inside Container Station containers or third-party apps isn’t covered by QNAP’s updates. Those need fixes from whoever made the image or app.

Keep the box off the internet while you update

Until the fixes are installed, QNAP’s advice is to cut the box’s exposure to the internet. Its steps: turn off router port forwarding and UPnP, and use a VPN for remote access instead. It also suggests stopping PHP-based apps you don’t use.

If you think a box has been compromised, QNAP says to disconnect it, change all passwords and contact its support team. The ACSC also takes calls from organisations that have been affected or suspect they have.

Checklist

  • Check which system your storage box runs. Look for Synology DSM or QNAP QTS, QuTS hero or QuTScloud, or ask whoever set it up.
  • On Synology, update PHP in Package Center. Do it if you use Web Station, WordPress, Calendar, MailStation, Joomla, MediaWiki, phpMyAdmin, KodExplorer, vtigerCRM or IDrive.
  • Update MailStation separately. Synology says it needs a manual update through Package Center.
  • Switch off affected packages on Synology systems older than DSM 6.2. Leave them off until you move to a supported DSM version.
  • On QNAP, run Live Update. Go to Control Panel > System > Firmware Update > Live Update, then update Notes Station 3 in App Center if you use it.
  • Ask for fixes for PHP in containers and third-party apps. QNAP’s updates don’t cover them, so go to whoever made the image or app.
  • Turn off port forwarding and UPnP for the storage box. Use a VPN for remote access instead.
  • Disconnect a box you think has been attacked. Change all passwords, then contact QNAP support for a QNAP box, or the ACSC on 1300 CYBER1 (1300 292 371).
Download checklist PDF
ShareShare this checklist on LinkedIn (opens in a new tab)Share this checklist on Facebook (opens in a new tab)Share this checklist on X (opens in a new tab)Share this checklist on WhatsApp (opens in a new tab)Share this checklist by Email
More in Scams & security
a close-up of a halftone hand holding a smartphone just above a car's steering wheel, with the phone screen showing a single text-message bubble, while the long arm of a halftone toll-booth boom gate swings down diagonally across the phone and the hand. the boom gate arm is the only full-colour object, striped bright red and white, and the sender name at the top of the phone screen reads "Unverified" in bold red; the only readable word

Spot the scamScams & security

Spot the scam: the unpaid toll text

A text says you owe a toll and must pay by link today. Here’s each warning sign the toll operators list, how to check for a real toll in a minute, and what to do if you paid.

4 min read