Do Son QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.
QTS
QNAP patched 14 NAS vulnerabilities in QTS, QuTS hero, and QVP, including command injection and credential-theft flaws. Update your QNAP NAS now.
QNAP patched 7 zero-day flaws in QTS/QuTS hero and apps (HBS 3, Malware Remover) after being hacked by researchers at Pwn2Own Ireland 2025. Update urgently.
A severe zero-day vulnerability (CVE-2023-50358) has been discovered in QNAP Network Attached Storage (NAS) devices
The technical details and a PoC exploit of CVE-2023-39296 were unveiled by an independent security researcher, DCS