From News Desk

Following a thorough investigation, the Synology Product Security Incident Response Team (PSIRT) has confirmed that the impact of the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) is limited to systems running certain PHP-dependent packages. The affected packages are Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress.

Synology has released PHP security updates on DiskStation Manager (DSM) 7.4 and DSM 7.3, as well as the end-of-life DSM 7.2, DSM 7.1, and DSM 7.0. A patch for DSM 6.2 is scheduled for October 29, 2026. Users of the affected packages are strongly advised to update PHP through Package Center immediately. Once the PHP update is complete, dependent packages restart automatically and the vulnerabilities are resolved. For systems running DSM versions earlier than 6.2, Synology recommends temporarily disabling the affected packages to mitigate risk before updating to a supported DSM version.

DSM also contains a PHP component for internal system use. By architectural design, this component does not include any externally accessible modules and therefore has no exposed attack surface. Synology PSIRT has assessed the risk as minimal and scheduled a patch for a subsequent DSM release to ensure consistent vulnerability scan results and compliance status.