CVE-2026-109618 / CVE-2026-109619, QNAP QTS, QuTS hero and QuTScloud: the PHP2Shell flaws reach the NAS web components before authentication; fixed builds of 2026-10-23, other QNAP products still unfixed
PHP2Shell hits QNAP NAS before login: QTS and QuTS hero builds of 23 October fix it, other QNAP products still unfixed
Defender actions
- Update every QNAP NAS on QTS, QuTS hero or QuTScloud to the builds of 2026-10-23 (QTS 6.1.0.3656 or 5.2.11.3661, QuTS hero h6.1.0.3656, h6.0.2.3656 or h5.2.11.3661, QuTScloud c5.2.9.3661), and take any QNAP device running Note Station 3, QNE, QVR Surveillance, TVR OS or QuMagie off the internet until QNAP lists a fix.
Analysis
QNAP's advisory QSA-26-18 says the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0 9.2) affect the PHP used in the web components of its operating systems and several of its applications, can be triggered before any application-level authentication, and could let an unauthenticated remote attacker execute code on the device (QNAP, 2026-10-24). Its revision of 2026-10-24 lists fixed builds dated 2026-10-23 for QTS (6.1.0.3656 and 5.2.11.3661), QuTS hero (h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661) and QuTScloud (c5.2.9.3661), while Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier on ARM32 models and TVR OS 1.0.4 and earlier are still being fixed with no date announced, and QuMagie 2.10.1 and earlier is named as affected without a row in the fix table (QNAP, 2026-10-24). QNAP's PSIRT says it has observed scanning and exploitation attempts against the flaws in the wild and blocked attempts against its own website, online store and cloud services (QNAP, 2026-10-22), and its advisory says it has received no reports of exploitation targeting QNAP products (QNAP, 2026-10-24). PHP inside Container Station containers or third-party applications is not covered by QNAP's updates (QNAP, 2026-10-24).
Synology's advisory Synology-SA-26:14 rates its PHP 7.3 to 8.4 packages, Mail Station and Synology Calendar critical and lists fixed releases for each except the end-of-life PHP 7.3 package, which gets no fix; Synology says the PHP built into DSM is not exposed to external attack surfaces and considers the risk of exploitation very low (Synology, 2026-10-22).
Cited evidence
Both vulnerabilities can be triggered before any application-level authentication takes place.
QNAP PSIRT has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild.
QNAP has not received reports of exploitation targeting QNAP products.
Until fixed versions are available, the most effective protection is to keep the device off the internet.
The built-in PHP in OS is not exposed to external attack surfaces, and the risk of exploitation is considered very low.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.