Hello,
NAS vendors have recently published notices about ransomware attacks and security vulnerabilities. If you use RaiDrive with a NAS, please check the vendor notices below and update your NAS as the vendor advises.
Synology
- On October 29, 2026, Synology announced that devices running outdated DSM versions are being attacked by ransomware. According to Synology, the attackers exploit a vulnerability that was patched in December 2024. Synology urges users to update DSM immediately and to enable automatic updates. → Synology announcement, Synology-SA-24:20
- On October 22, 2026, Synology announced that the PHP vulnerabilities (PHP2Shell) affect packages that use PHP (such as Web Station, WordPress, Calendar and MailStation), not DSM itself. Synology advises users to update PHP in Package Center. → Synology PHP2Shell announcement
- How to update: DSM update guide
QNAP
- On October 22, 2026, QNAP announced that the PHP vulnerabilities (PHP2Shell) affect QTS, QuTS hero, QuTScloud, Notes Station 3 and other products. QNAP reported that it observed scans and attack attempts that target these vulnerabilities. The fixed versions are listed in the advisory. → QSA-26-18, QNAP statement
- As mitigations, the QNAP advisory advises users to disable port forwarding and UPnP on the router and to stop PHP-based apps that are not needed.
- How to update: QTS firmware update guide
ASUSTOR
- On October 22, 2026, ASUSTOR announced that the PHP vulnerabilities (PHP2Shell) affect ADM and released fixed PHP packages. As mitigations, the advisory advises users to disable the web server and to remove PHP versions that are no longer supported. → AS-2026-023
- On October 7, 2026, ASUSTOR fixed an ADM vulnerability that let attackers read files on the NAS without signing in. The fixed versions are ADM 5.1.4.RM62 and 4.3.3.RY62. → AS-2026-022
- How to update: ADM update guide
ipTIME
- On October 23, 2026, ipTIME released NAS firmware that fixes the PHP remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619). The fixed versions are 1.6.14 for NAS4dual, NAS2plus, NAS2dual and NAS1dual, and 1.1.18 for NAS400plus, NAS200plus, NAS400 and NAS200. → Firmware 1.6.14 notice, Firmware 1.1.18 notice
- How to update: Automatic upgrade with the NAS helper tool, Manual upgrade
Buffalo
- Since October 22, 2026, Buffalo has been investigating and publishing the impact of the PHP vulnerabilities (updated October 27). Buffalo reported that the LinkStation and TeraStation online update service has been fixed and that most NAS models are not affected. The LS520D, LS510D, LS520DG, LS510DG, LS520DNB and LS510DNB series are still under review. → Buffalo notice
- How to update: TeraStation firmware update guide, LinkStation firmware update guide
Unraid
- Unraid 7.3.4, released on October 22, 2026, updated PHP to 8.4.27. The release notes say that it “addresses multiple reported PHP vulnerabilities”. PHP 8.4.27 is the version that the PHP project released on October 21, 2026 to fix PHP2Shell. → Unraid 7.3.4 release notes, PHP 8.4.27 release
- How to update: Unraid update guide
TrueNAS
- TrueNAS stated that TrueNAS itself is not affected by PHP2Shell because it does not include PHP. However, apps that use PHP, such as Nextcloud, must be updated separately. → TrueNAS impact statement
- How to update: TrueNAS update guide
If you suspect an infection
- Contact the support team of your NAS vendor.
Thank you.