Ransomware is hitting Synology NAS devices on outdated DSM: update now

What happened

On 29 October 2026 Synology said that attackers are exploiting a DSM vulnerability it patched in December 2024. The targets are network-attached storage (NAS) devices running outdated, mostly end-of-life DSM releases. The attackers encrypt the data on the device and demand a ransom.

Synology links the attacks to its older advisory Synology-SA-24:20. It doesn't say which of that advisory's three flaws is being exploited, and it doesn't name the ransomware. HKCERT, Hong Kong's computer emergency response team, issued an alert on 2 November 2026 and points out that synced folders and connected backups can be hit along with the data on the NAS itself.

In the same statement Synology extended its fixes for a separate set of PHP bugs, PHP2Shell, to older DSM releases. It hasn't confirmed whether PHP2Shell plays any part in the ransomware attacks.

Technical details

Synology-SA-24:20 was published on 5 November 2024. Full vulnerability details followed in March 2025. It covers three flaws in DSM and BeeStation OS:

Synology describes all three as exploitable "via unspecified vectors" and hasn't published how an attack works. That makes CVE-2024-10441 the obvious concern: a remote attacker who can reach the device can run code on it without credentials. That's enough to encrypt the shares. NVD lists the CVE as analysed, with Synology's own 9.8 score, and as of 13 November 2026 NVD shows no CISA Known Exploited Vulnerabilities (KEV) entry for it (nor for CVE-2024-50629 or CVE-2024-10445).

The PHP2Shell flaws (Synology-SA-26:14, published 22 October 2026) are memory-handling bugs in PHP itself, both rated 9.8:

• CVE-2026-109618 – PHP uses longjmp() to bail out of a request when it runs out of memory. In some code paths, request memory is still uninitialised at that point, and later cleanup can read it, which can lead to remote code execution.
• CVE-2026-109619 – some of PHP's global state temporarily points into request memory and isn't always reset. A later request can then act on freed memory, which can also lead to remote code execution.

CISA added both PHP2Shell flaws to its KEV catalog on 26 October 2026 as PHP vulnerabilities. That confirms exploitation of PHP in general, not specifically on Synology devices; neither Synology nor HKCERT has linked PHP2Shell to the NAS ransomware attacks.

Only NAS devices that run a PHP-based package are exposed: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. Synology says Synology Drive isn't affected. It also says the PHP built into DSM isn't reachable from outside and rates the risk there as very low.

Who is affected

Anyone with a Synology NAS that isn't kept up to date, typically:

• households storing photos and backups,
• small businesses and offices with shared folders on a NAS,
• devices reachable from the internet through port forwarding or remote management.

The older the device, the higher the risk, because many models can no longer install current DSM. Synology lists DSM 7.2, 7.1, 7.0 and 6.2 as end of life.

The SA-24:20 fixes arrived in these builds (or later):

BeeStation OS is fixed in 1.1-65374 and later. These builds are the 2024 minimum, not the target. Compare the full build number on your device and install the newest release your model supports.

For PHP2Shell, the fixed PHP packages include PHP 7.4 7.4.33-0131 (DSM 7.2 and later), 7.4.33-0122 (DSM 7.0–7.1) and 7.4.33-0010 (DSM 6.2), and PHP 8.0 to 8.4 builds listed in SA-26:14. PHP 7.3 won't be fixed because it has reached end of life. Calendar and MailStation have their own fixed builds in the advisory.

How to tell if you were compromised

Neither Synology nor HKCERT has published indicators of compromise, a ransomware name or log patterns for these attacks. What you can check:

• Encrypted or renamed files and a ransom note in your shared folders. This is usually the first visible sign.
• Your DSM build under Control Panel → Update & Restore. If it's older than the table above and the NAS was reachable from the internet, treat the device as suspect.
• DSM logs (Log Center) for sign-ins, new user accounts, permission changes or packages you didn't install. Also look for scheduled tasks you didn't create.
• Exposure from outside: router port-forwarding rules and remote access settings that publish DSM or a PHP-based package (Web Station, WordPress, phpMyAdmin) to the internet.

These checks are our own suggestions, not vendor guidance. If anything looks off, follow the steps under "If your data is already encrypted".

What to do

1. Update DSM to the newest release your model supports. Synology urges everyone on a vulnerable version to update immediately.
2. Turn on automatic DSM updates, as Synology recommends.
3. Update PHP in Package Center if you use any of the packages listed above. Dependent packages restart on their own, but MailStation needs updating by hand. On DSM older than 6.2, Synology says to disable the affected packages for now and move to a supported DSM release.
4. Plan to replace or upgrade end-of-life devices. Synology says the PHP fixes don't restore full support for older releases.
5. Keep NAS management off the internet. Remove port forwarding and services you don't need, and limit remote access, for example to a VPN.
6. Keep a backup that doesn't live on the NAS – offline or immutable – and test restoring from it now and then. RAID and sync aren't backups: encrypted files sync like any other change.
7. Use strong, unique passwords for NAS accounts. Our password generator can create them, and a password manager keeps them in one place.

If your data is already encrypted

HKCERT recommends these steps:

1. Disconnect the NAS from the network and pause sync and backup jobs so the damage doesn't spread.
2. Keep the evidence – the ransom note, samples of encrypted files, system and access logs and the time you noticed. Don't reset, format or needlessly restart the device.
3. Bring in an expert – your IT support or an incident response firm – to find out how the attacker got in and what was affected.
4. Clean up before restoring: remove malware and unauthorised access, install updates, change passwords from a clean device, and only then restore from a verified clean backup.
5. Don't count on paying. A ransom doesn't guarantee your data back, and security updates won't decrypt files that are already encrypted.

Report the attack to the police and, for organisations, to your national cyber authority – in the UK the NCSC, in the US CISA or the FBI's IC3.

Timeline

Updates

• 13 Nov 2026 - one-week review: added that CISA put both PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) in its KEV catalog on 26 October 2026 as exploited PHP vulnerabilities. Synology has published nothing new since 29 October and still names no ransomware family or indicators of compromise.
• 8 Nov 2026 - first version of this article.