lhsei
October 21, 2026, 1:10pm
1
Dear forum members,
There are currently worldwide attacks targeting PHP.
Critical Vulnerabilities in PHP
Critical Vulnerabilities in PHP
cert.europa.eu
If you are still using the internal web server/internal PHP for applications accessible from the internet, you should IMMEDIATELY disable all access.
Containerized applications (e.g. Nextcloud-AIO, etc.) are also affected and should be taken offline as a precaution until patched containers are available.
1 Like
By now, it should be clear to everyone that NAS devices should never be exposed to the Internet.
2 Likes
Apparently there’s been a patch since 4 p.m.
Hallo zusammen,
aufgrund der aktuellen PHP-Sicherheitslücken CVE-2026-109618 und CVE-2026-109619 hat sich der Betreiber dazu entschlossen, den Webserver temporär vom Netz zu nehmen, da es schon funktionierende Exploits, aber noch keine Updates gibt....
1 Like
There’s also an announcement from QNAP
https://www.qnap.com/en/security-advisory/qsa-26-18
and a new post from QNAP
Hi everyone,
Two critical vulnerabilities in PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 score 9.2), have been disclosed. Multiple QNAP products are affected. Please see the official links below for details.
QNAP is working on fixes, and updated versions will be released as they become available. For affected versions and the latest status, please see the official links below.
Until fixes are released, we recommend that you:
Keep your NAS off the public interne…
