QNAP has no patch yet for critical PHP flaws in its NAS devices
QTS, QuTS hero and other products are affected by PHP2Shell. QNAP sees exploitation attempts on the internet and gives no date for a fix.
QNAP still has no fixed versions for two critical PHP flaws that affect its NAS devices and other products. Advisory QSA-26-18, published Thursday, marks every fix as in progress and gives no release date for any patch.
The flaws, CVE-2026-109618 and CVE-2026-109619, are known together as PHP2Shell and allow remote code execution without authentication. QNAP rates them 9.2 out of 10 on the CVSS v4.0 scale, which measures the severity of a vulnerability, and classifies them as critical.
| Product | Affected versions | Fixed version |
|---|---|---|
| QTS | 6.1.0; 5.2.11 and earlier | To be announced |
| QuTS hero | h6.1.0; h6.0.x; h5.2.11 and earlier | To be announced |
| QuTScloud | c5.2.9 and earlier | To be announced |
| QuMagie | 2.10.1 and earlier | To be announced |
| Note Station 3 | 3.9.14 and earlier | To be announced |
| QNE (ADRA) | 1.0.7 and earlier | To be announced |
| QVR Surveillance | 3.0.3 and earlier, ARM32 models only | To be announced |
| TVR OS | 1.0.4 and earlier | To be announced |
QNAP says in its statement that it observed scans and exploitation attempts on the internet and blocked attacks against its website, its store and its cloud services, with no evidence that user data was accessed. In the NAS advisory, it says it has received no reports of exploitation against its products.
PHP itself was patched on Oct. 21, in versions PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. One exploitation attempt was recorded four days before that disclosure. The flaw has already knocked Dutch government websites offline.
Until a patch arrives, QNAP recommends reducing the device's exposure:
- Turn off port forwarding and UPnP, and use a VPN for remote access.
- Limit the administration ports, 8080 and 443 by default, to trusted networks.
- Stop any affected apps that are not in use.
- Scan the device with Security Center and Malware Remover.
The company notes that these measures do not fix the flaws and that PHP in Container Station containers or third-party apps falls outside its updates. The same product list appears in Spain's national CERT bulletin. Once fixed versions are out, QNAP asks users to update immediately from Firmware Update.
