KISA warns of critical PHP2Shell flaws in Synology NAS products
The advisory, issued October 29, 2026, covers two vulnerabilities rated 9.8 that allow unauthenticated remote code execution.
KISA published a security update advisory on October 29, 2026, urging users of affected Synology NAS products to patch quickly against critical vulnerabilities tied to PHP2Shell, according to dailysecu.com. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are rated 9.8 on the CVSS 3.1 scale, with the potential to allow unauthenticated remote code execution.
Affected Synology components include Synology Calendar, Mail Station and the PHP 7.3 to 8.4 packages. Other PHP-based applications such as WordPress, Web Station, phpMyAdmin, Joomla and MediaWiki may also be affected.
Which updates to install
Synology released PHP security updates for DiskStation Manager (DSM) 7.4, 7.3, 7.2, 7.1, 7.0 and 6.2. Synology Calendar must be updated to 3.0.4-21435 or later and Mail Station to 30000002.3.19-20333 or later.
No security patch is provided for the end-of-life PHP 7.3, so users must migrate to a supported version. Synology recommends applying PHP updates through Package Center, while Mail Station requires a separate manual update. For DSM versions older than 6.2, Synology advises temporarily disabling affected packages and upgrading to a supported DSM version.
Synology's investigation found the vulnerabilities affect systems using certain PHP-based packages. The company stated that the PHP components used internally by the NAS operating system cannot be accessed directly from outside, making exploitation risk very low.
Quick answers
Which Synology products are affected by the PHP2Shell vulnerabilities?
Synology Calendar, Mail Station and the PHP 7.3 to 8.4 packages, along with other PHP-based applications such as WordPress, Web Station, phpMyAdmin, Joomla and MediaWiki that may also be affected.
How serious are CVE-2026-109618 and CVE-2026-109619?
Both are rated 9.8 on the CVSS 3.1 scale and could allow unauthenticated remote code execution.
How do I update my Synology NAS?
Synology recommends applying PHP updates through Package Center; Mail Station requires a separate manual update. Users on DSM versions older than 6.2 should temporarily disable affected packages and upgrade to a supported DSM version.