PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Synology Packages — What NAS Owners Need to Do

Separate from the C3RB3R ransomware story, Synology is racing to patch PHP2Shell — two critical vulnerabilities in PHP itself (CVE-2026-109618, CVE-2026-109619) that allow unauthenticated remote code execution on affected PHP installations serving web requests. The US CISA added both to its Known Exploited Vulnerabilities catalog on 26 October 2026, and Synology has confirmed active exploitation attempts.

Which Synology packages are affected

Not DSM itself — the PHP-dependent packages: Calendar, IDrive, Joomla, KodExplorer, Mail Station, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress. Synology Drive and Hyper Backup are not affected. Synology has shipped PHP security updates through Package Center for DSM 7.4 and 7.3, and extended fixes to older branches including DSM 7.2, 7.1, 7.0 and even 6.2.

What to do

1. Open Package Center and update every package — especially the list above.
2. If you run WordPress/Joomla/phpMyAdmin you don't actively use, uninstall them: every PHP web app is a door.
3. Re-check after each DSM update; Synology has been shipping staged fixes.

Is PHP2Shell what encrypted people's NAS?

Based on published reports: no confirmed link. C3RB3R entry is attributed to DSM flaws (see the incident page). But both stories land in the same month, and both have the same cure: update everything, expose nothing.

Is PHP2Shell the cause of the Synology ransomware attacks?

No published report establishes that link. The ransomware entry is attributed to DSM vulnerabilities (CVE-2026-13639/13684 per Qihoo 360, or CVE-2024-10441 per Synology). PHP2Shell is a separate, actively-exploited flaw in PHP packages — patch both, don't confuse them.

My NAS is on DSM 6.2 — am I covered?

Yes for PHP2Shell: Synology extended the PHP package fixes down to DSM 6.2. Open Package Center and update. But note DSM 6.x has no fix for the SA-26:13 DSM flaws used by the ransomware — isolation remains the answer there.