PHP2Shell Reaches NAS Software as Synology Patches Packages and QNAP Works on Fixes

The Short Version

PHP2Shell’s update story now extends to network-attached storage devices. TechRadar reports affected NAS software and PHP-based applications running in Docker, with patch availability differing between vendors.

Synology has released updated PHP packages, according to the report. QNAP says it is working on fixes but has not given a release timetable.

Why It Matters

A NAS can contain more than one PHP installation. The report distinguishes vendor-maintained software from applications inside container images. Updating one therefore does not establish that every PHP-based service on the device has received a fix.

For Synology, TechRadar identifies affected PHP packages, Mail Station and Synology Calendar, and points to updated PHP 8.2 and 8.4 packages. Exact fixed package build numbers are not supplied in the account.

The Bigger Picture

Synology also distinguishes installed packages from PHP built into DiskStation Manager. TechRadar says the company describes that built-in component as not exposed to the public internet; that should not become a blanket assurance about every service on a NAS.

The report separately relays QNAP’s recommendation to remove devices from public internet exposure and disable unnecessary port forwarding, UPnP and remote-access services. Those precautions address reachability while fixes remain pending.

What to Watch

Vendor notices for particular models and software packages will make the patch position clearer, especially where a release date is absent. PHP-based Docker applications also need their image versions checked, the report says.

The account does not establish a confirmed compromise of a specific NAS. Its discussion of wider PHP exploitation should not be treated as proof that a particular storage device has been breached.

How easy is it to tell which apps and container images on your NAS maintain their own PHP installation?