We checked this claim: is it true that

Synology expanded security updates for the PHP2Shell flaws to older operating system versions?

Confirmed

Synology updated its advisory to provide software fixes for operating system versions 6.2, 7.0 and 7.1

Tech & AI

Synology shields older storage drives from critical flaws

Synology expanded security patches for the PHP2Shell remote code flaws to older operating systems including versions 6.2 and 7.

Published
NRB — News Republic Brigade

In a nutshell

Synology extended emergency software patches to older, discontinued storage drives after critical flaws in the widely used PHP programming language exposed connected devices to remote takeovers. While the core operating system faces low exposure from the web, administrators must manually update specific add-ons and retire obsolete software components to secure their hardware.

Highlights

  • Upstream software maintainers rated the PHP2Shell remote code execution flaws 9.8 out of 10 for severity
  • Synology issued an initial security advisory on October 22, 2026 covering modern releases of PHP, Calendar, and Mail Station
  • Revision 2 of the advisory confirmed internal package Hyper Backup was unaffected by the memory flaws
  • Revision 4 on October 31, 2026 extended fixes for Calendar and Mail Station back to legacy operating system 6.2
  • Older PHP version 7.3 remains permanently unpatched due to upstream deprecation

From the Editor’s Diary

Even when manufacturers backport emergency fixes to abandoned hardware, incomplete upstream support shifts the final security burden onto system operators.

Who's involved

  • Synology Inc.

    Taiwanese network-attached storage manufacturer

    goal → patch critical code flaws across active and older storage machines

  • PHP Development Team

    Upstream open-source project maintaining PHP

    goal → fix memory-management flaws CVE-2026-109618 and CVE-2026-109619

  • NAS Administrators

    Enterprise and home operators managing Synology storage units

    goal → update software packages and isolate legacy web services from the public internet

In short

Owners of older Synology data storage drives can now shield their systems from critical internet hijacking flaws after the company pushed rare fixes to discontinued software.

Network administrators must now manually install these package updates and retire unsupported web components to prevent unauthorized takeovers.

Full protection across business and home networks is likely, but only if administrators actively update their applications and isolate exposed web management screens behind internal network firewalls.

How it unfolded

01

Critical PHP2Shell Vulnerabilities Disclosed Upstream

2026-10-22 – 2026-10-22

Maintainers of the open-source PHP language issued emergency fixes for two high-severity memory-handling flaws, rated 9.8 out of 10 for risk, forcing connected storage vendors to examine their systems.

1 source
02

Extension of Fixes to Legacy DSM Versions

2026-10-26 – 2026-10-31

Mounting independent scrutiny and internal software reviews pushed Synology to expand safeguards to older machines, confirming its primary backup tool was safe while backporting fixes to retired system editions.

3 sources

Where things stand

Updated applications for Calendar, Mail Station, and supported PHP engines are now available through Synology's built-in software catalog for platforms ranging from legacy version 6.2 to current models.

Network managers must install the new packages, migrate hosted websites away from unpatched PHP 7.3, and place management consoles behind private network connections to fully eliminate exposure.

PHP2Shell: the PHP security crisis

Open the dashboard →

Sources