Dear QNAP users,
Two major security vulnerabilities in PHP have been recently disclosed, named “PHP2Shell” (CVE-2026-109618, CVE-2026-109619, CVSS v4.0 score 9.2). Multiple QNAP products are affected—see the announcement link for details.
QNAP is currently working on a fix, and updated versions will be released gradually. For affected versions and the latest progress, please refer to the official links below.
Before the bugfix releases, we recommend the following measures:
- Do not expose your NAS directly to the internet—please disable port forwarding and UPnP on your router
- If remote access is needed, please use a VPN instead
- Allow the management ports only from trusted networks
These steps can reduce your risk, but cannot completely patch the vulnerabilities. When the fix becomes available, please update your firmware and related apps as soon as possible.
Official links:
- QNAP statement regarding critical PHP vulnerabilities (PHP2Shell): https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell
- Security advisory QSA-26-18: https://www.qnap.com/en/security-advisory/qsa-26-18
If you have any questions, please feel free to leave a comment in this thread.