CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

QNAP QuTScloud

product · product:qnap-qutscloud single-source

Coverage
1
first 2026-10-25 → last 2026-10-25
Latest activity
2026-10-25
PHP2Shell hits QNAP NAS before login: QTS and QuTS hero builds of 23 October fix it, other QNAP products…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
3
2 hosts

Action items (1)

Do-now tasks recorded on the entries about QNAP QuTScloud, newest first. Check the date before acting on an older one.

  • Update every QNAP NAS on QTS, QuTS hero or QuTScloud to the builds of 2026-10-23 (QTS 6.1.0.3656 or 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 or h5.2.11.3661, QuTScloud c5.2.9.3661), and take any QNAP device running Note Station 3, QNE, QVR Surveillance, TVR OS or QuMagie off the internet until QNAP lists a fix.
    2026-10-25CVE-2026-109618 +1

Defender insights

What each entry about QNAP QuTScloud tells a defender to do, newest first.

2026-10-25NOTABLEPHP2Shell hits QNAP NAS before login: QTS and QuTS hero builds of 23 October fix it, other QNAP products still unfixed

Exposure · detection

Story timeline

  1. 2026-10-25CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, other QNAP products still unfixed
    trending-vulnerabilitiesPHP2Shell hits QNAP NAS before login: QTS and QuTS hero builds of 23 October fix it, other QNAP products still unfixed

Hunting pivots

CVEs
CVE-2026-109618CVE-2026-109619
Releases covered
QNAP QuTScloud
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-25/qnap-synology-php2shell-qts-quts-hero-fixed-others-unfixed · ATT&CK page ↗

Entries about QNAP QuTScloud (1)

2026-10-25 · view entry permalink →

NOTABLECVE-2026-109618 +1NATOA2

CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, other QNAP products still unfixed

QNAP's advisory QSA-26-18 says the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2) affect the PHP used in the web components of its operating systems and several of its applications, can be triggered before any application-level authentication, and could let an unauthenticated remote attacker execute code on the device (QNAP, 2026-10-24). Its revision of 2026-10-24 lists fixed builds dated 2026-10-23 for QTS (6.1.0.3656 and 5.2.11.3661), QuTS hero (h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661) and QuTScloud (c5.2.9.3661), while Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier on ARM32 models and TVR OS 1.0.4 and earlier are still being fixed with no date announced, and QuMagie 2.10.1 and earlier is named as affected without a row in the fix table (QNAP, 2026-10-24). QNAP's PSIRT says it has observed scanning and exploitation attempts against the flaws in the wild and blocked attempts against its own website, online store and cloud services (QNAP, 2026-10-22), and its advisory says it has received no reports of exploitation targeting QNAP products (QNAP, 2026-10-24). PHP inside Container Station containers or third-party applications is not covered by QNAP's updates (QNAP, 2026-10-24).

Synology's advisory Synology-SA-26:14 rates its PHP 7.3 to 8.4 packages, Mail Station and Synology Calendar critical and lists fixed releases for each except the end-of-life PHP 7.3 package, which gets no fix; Synology says the PHP built into DSM is not exposed to external attack surfaces and considers the risk of exploitation very low (Synology, 2026-10-22).

Both vulnerabilities can be triggered before any application-level authentication takes place.

QNAP PSIRT (QSA-26-18, revision V1.1) 2026-10-24

QNAP PSIRT has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild.

QNAP (statement on PHP2Shell) 2026-10-22

QNAP has not received reports of exploitation targeting QNAP products.

Until fixed versions are available, the most effective protection is to keep the device off the internet.

QNAP PSIRT (QSA-26-18, revision V1.1) 2026-10-24

The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low.

Synology PSIRT (Synology-SA-26:14) 2026-10-22

Builds on: PHP2Shell: fixed PHP builds are out and attack traffic hits unpatched servers; update the… · Palo Alto: PHP2Shell affects PAN-OS and Panorama; first PAN-OS hotfixes out, the rest due by 30… · NetScaler management GUI is affected by PHP2Shell on all supported versions; fixes 2026-10-27…

vulnerability25 Oct 14:10Zsingle-sourceOpen finding →
Sources: QNAP PSIRT (QSA-26-18, revision V1.1) · QNAP (statement on PHP2Shell) · Synology PSIRT (Synology-SA-26:14)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • qnap.com2 (67%)
  • synology.com1 (33%)
All cited sources (3)