QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
Do Son 
TL;DR
QNAP says the QNAP PHP2Shell vulnerabilities affect QTS, QuTS hero, QuTScloud and several QNAP apps. The two flaws, CVE-2026-109618 and CVE-2026-109619, let unauthenticated attackers run code on a NAS. No patches exist yet, so QNAP urges users to take devices off the internet.
- Product: PHP Group PHP
- Vulnerabilities: 2 flaws (CVE-2026-109618, CVE-2026-109619)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: RCE via OOM corruption
- Status: Exploited in the wild
- Action: Update to 8.2.35, 8.3.36, 8.4.27, 8.5.12 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | RCE via OOM corruption | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited in the wild |
| CVE-2026-109619 | 9.2 | RCE via stale global state | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited in the wild |
Why It Matters
QNAP devices use PHP in their web interfaces and in several apps. According to QNAP, both flaws “can be triggered before any application-level authentication takes place.” That makes internet-facing NAS boxes an easy target. In short, the QNAP PHP2Shell vulnerabilities need no login and no user action.
The wider threat is already active. Amazon Threat Intelligence says PHP2Shell “is now being broadly exploited in the wild,” with the first attempt seen on October 17. Even so, QNAP says it “has not received reports of exploitation targeting QNAP products.”
How the Attack Works
Both bugs live in PHP itself, not in QNAP’s own code. The PHP project fixed them on October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- CVE-2026-109618 (CVSS 9.2): a crafted HTTP request exhausts memory while request data is “only partly initialized.” PHP cleanup then processes invalid data.
- CVE-2026-109619 (CVSS 9.2): a later request on the same PHP worker “can access memory freed by an earlier request.” This can lead to code execution or memory leaks.
Exploitation status
Public PoC exploits for PHP2Shell exist, and attacks on PHP servers are widespread. However, no source confirms attacks against QNAP devices so far.
Affected Versions
The QNAP security advisory lists these products as affected, with fixes “To be announced”:
- QTS 6.1.0, and QTS 5.2.11 and earlier
- QuTS hero h6.1.0, h6.0.x, and h5.2.11 and earlier
- QuTScloud c5.2.9 and earlier
- Note Station 3 3.9.14 and earlier
- QNE (ADRA) 1.0.7 and earlier
- QVR Surveillance 3.0.3 and earlier on ARM32 models
- TVR OS 1.0.4 and earlier
Patch and Mitigation Steps
Until patches arrive, QNAP says “the most effective protection is to keep the device off the internet.”
- Disable port forwarding and UPnP on your router and in myQNAPcloud.
- Turn off myQNAPcloud Link and unpublish unneeded services.
- Use QVPN or your router’s VPN for remote access.
- Limit management ports 8080 and 443 to trusted subnets with QuFirewall.
- Stop unneeded PHP-based apps and the built-in web server.
- Check QuLog Center, then run Security Center and Malware Remover.
If you suspect compromise, disconnect the device, change all passwords and contact QNAP Support. Note that PHP inside Container Station images or third-party apps needs fixes from those vendors.
QNAP admits these steps “do not fully fix the vulnerabilities.” Watch the advisory, and install fixes for the QNAP PHP2Shell vulnerabilities as soon as they ship.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
