Your Synology box sits in a closet doing its job, backing up the family Mac every night, and you haven’t logged in to it since spring. That quiet habit is exactly why this week’s Synology NAS update deserves ten minutes of your Sunday.
Synology has rated a pair of PHP bugs, which it calls PHP2Shell, as Critical, and both flaws carry a CVSS score of 9.8 out of 10. The fixes arrive as package updates rather than a single system patch, so a NAS that only installs DSM updates may still be running a vulnerable add-on.
The short answer on the PHP2Shell Synology NAS update
If your NAS runs Synology Calendar, Mail Station or any of the PHP packages, update them now. Synology also flags PHP-based apps such as WordPress, phpMyAdmin, MediaWiki and Web Station. Synology published advisory Synology-SA-26:14 on October 22, 2026, and revised it on October 26 and again on October 29. The status now reads Resolved, which means patched versions exist. It does not mean your box already has them.
Synology’s own wording says a remote attacker could run code of their choosing through older builds of these packages. Hyper Backup was named in the summary after the October 26 revision, though the product table currently marks it as not affected.
Which packages need a Synology NAS update, and to what version
Compare the version number in your Package Center with the minimum safe build below. Anything lower is still exposed.
| Package | Minimum fixed version |
|---|---|
| Synology Calendar | 3.0.4-21435 |
| Mail Station | 30000002.3.19-20333 |
| PHP 7.3 | None, end of life |
| PHP 7.4 | 7.4.33-0131 (DSM 7.2+), 7.4.33-0122 (DSM 7.0 to 7.1), 7.4.33-0010 (DSM 6.2) |
| PHP 8.0 | 8.0.30-0122 (DSM 7.2+), 8.0.30-0104 (DSM 7.0 to 7.1) |
| PHP 8.1 | 8.1.34-0120 |
| PHP 8.2 | 8.2.35-0171 |
| PHP 8.3 | 8.3.36-0051 |
| PHP 8.4 | 8.4.27-0051 |
The October 29 revision matters for owners of older hardware. It added builds for DSM 6.2, 7.0 and 7.1, so a NAS that never moved to DSM 7.2 can now be patched for PHP 7.4, and for PHP 8.0 on DSM 7.0 and 7.1.
How the bugs work, minus the jargon
Both flaws, CVE-2026-109618 and CVE-2026-109619, come from upstream PHP rather than from Synology’s own code. They involve memory that is not cleaned up properly.
- The out-of-memory bug. When PHP runs short of memory, it bails out of a request abruptly. Some code paths are left holding memory that was never set up, and the cleanup that follows can act on that garbage.
- The stale pointer bug. PHP keeps some shared bookkeeping that briefly points at memory belonging to one request. If that bookkeeping is not reset, the next request can trip over memory that has already been released.
In both cases, an attacker who can repeatedly trigger the condition may turn it into remote code execution. That is the worst outcome a server bug can have, and it explains why this Synology NAS update carries a 9.8 rating.
Why the risk depends on your setup
Synology adds one reassuring note. It says the PHP built into the operating system itself is walled off from outside traffic:
The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low.
Synology security advisory SA-26:14
That line covers DSM’s internal copy, not the optional packages you install yourself. If you run a self-hosted calendar, a mail server or a website on the NAS that faces the internet, treat the Synology NAS update as urgent. A box that only stores Time Machine backups on your home network is a lower-priority case, but there is no good reason to leave it unpatched.
The advisory does not say whether anyone has exploited these flaws against Synology hardware, but PHP2Shell itself has reportedly been exploited in the wild since late October, according to Recorded Future. It also gives no timeline for automatic installs.
What to do on your NAS today
- Sign in to DSM from a browser on your Mac and open Package Center, where the Synology NAS update for each package appears.
- Look through your installed packages for Synology Calendar, Mail Station and any PHP version, and install the pending updates.
- Check each version number against the table above, since a pending update you skipped weeks ago will not fix this on its own.
- If PHP 7.3 is installed and nothing depends on it, remove it. Synology says that version will never be patched.
- While you are signed in, check that DSM itself is current, because Synology also rated an earlier DSM advisory, SA-26:13 from September, as Critical.
The same habit that keeps your Mac and phone safe applies here. Our guide on how to update your iPhone or iPad covers the Apple side, and if you use a Mac app to manage the NAS, it is worth reviewing which apps have Full Disk Access on your Mac.
Frequently asked questions
Is a Synology DSM update enough to fix PHP2Shell?
No. The fixes ship as package updates for Calendar, Mail Station and PHP, so you need to update those packages as well as DSM.
Is this Synology NAS vulnerability being exploited?
Synology has not reported attacks on its devices, but PHP2Shell itself has reportedly been exploited elsewhere since late October.
Does Hyper Backup need an update?
Not according to the current product table, which marks Hyper Backup as not affected, even though the advisory summary still lists it.
Should you install this Synology NAS update now?
Yes, if your NAS runs any of the listed packages, and right away if any of them face the internet. Owners who use their box purely for local backups can wait until tonight, but not until next month. Checking for a Synology NAS update costs you a few minutes, while a NAS with someone else’s code on it holds everything you were trying to protect.
