Hi everyone,
Two critical vulnerabilities in PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 score 9.2), have been disclosed. Multiple QNAP products are affected. Please see the official links below for details.
QNAP is working on fixes, and updated versions will be released as they become available. For affected versions and the latest status, please see the official links below.
Until fixes are released, we recommend that you:
- Keep your NAS off the public internet by disabling port forwarding and UPnP on your router
- Use a VPN for remote access
- Restrict management ports to trusted networks
These steps reduce exposure but do not fully fix the vulnerabilities. Please update your firmware and apps as soon as the fixes are available.
Official links:
- QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell
- Security Advisory QSA-26-18: https://www.qnap.com/en/security-advisory/qsa-26-18