The PHP2Shell Threat: NAS Devices Under Critical Risk
Critical PHP flaws are now targeting network storage and containerised environments.
PHP2Shell: A Widespread Security Threat
A severe cybersecurity issue known as PHP2Shell has moved beyond websites to target Network Attached Storage (NAS) devices. These critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow hackers to execute remote code, steal sensitive data, or infect systems with malware. Experts have compared the scale of this incident to the notorious Spectre and Meltdown flaws, given its broad impact across the internet.
The Risks to NAS Users
NAS devices, frequently used for data backups or media servers, are particularly vulnerable if connected directly to the public internet. The issue is two-fold: both the device's operating system and the Docker containers running within it—if they utilise affected versions of PHP—are at risk.
Synology has already released updates for PHP 8.2 and 8.4 via its Package Center. The company clarified that the core of its DiskStation Manager is not immediately threatened, though additional packages such as Mail Station and Calendar require attention. Conversely, QNAP users must wait, as the company is still developing patches for systems including QTS and QuTS hero.
How to Protect Your System
While manufacturers prepare security updates, specialists strongly recommend the following measures:
- Disable Public Access: If your NAS is visible on the public internet, immediately disable port forwarding and UPnP services.
- Use a VPN: For remote access, rely on a secure VPN channel rather than exposing the device's management interface directly to the web.
- Update Docker Containers: Audit all running containers to ensure they are not using compromised versions of PHP.
- Manage End-of-Life Hardware: If your NAS device no longer receives manufacturer support, it must not be connected to the public internet under any circumstances.
While there is ongoing debate regarding why the current success rate of these attacks remains relatively low, security researchers agree it is only a matter of time before that changes. For users of NAS devices, particularly small businesses and home server owners, this serves as a signal to review network configurations immediately and await official updates from manufacturers.