Synology Statement on PHP2Shell Vulnerabilities

TAIPEI, Taiwan — October 22, 2026 — Following a thorough investigation, the Synology Product Security Incident Response Team (PSIRT) has confirmed that the impact of the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) is limited to systems running certain PHP-dependent packages. The affected packages are Calendar, IDrive¹, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress.

Synology has released PHP security updates on DiskStation Manager (DSM) 7.4, DSM 7.3, and DSM 7.2 (end of life). Users of the affected packages are strongly advised to update PHP through Package Center immediately. Once the PHP update is complete, dependent packages restart automatically² and the vulnerabilities are resolved. For systems running DSM versions earlier than 7.2, Synology recommends temporarily disabling the affected packages to mitigate risk before updating to a patched version.

DSM also contains a PHP component for internal system use. By architectural design, this component does not include any externally accessible modules and therefore has no exposed attack surface. Synology PSIRT has assessed the risk as minimal and scheduled a patch for a subsequent DSM release to ensure consistent vulnerability scan results and compliance status.

For further details and the latest updates, please refer to Synology Security Advisory Synology-SA-26:14.

1. IDrive is a third-party package. Synology Drive is not affected by PHP2Shell.
2. MailStation requires a manual update through Package Center.