Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products

Summary 

Two critical vulnerabilities (collectively known as "PHP2Shell") have been reported to affect PHP, an open-source scripting language used in the web components of QNAP operating systems and several QNAP applications. If exploited, these vulnerabilities could allow unauthenticated remote attackers to execute arbitrary code on the affected device. 

• CVE-2026-109618: Memory corruption during out-of-memory (OOM) handling. A crafted HTTP request can exhaust memory while request data is only partly initialized, causing PHP cleanup to process invalid data. CVSS v4.0: 9.2. 

• CVE-2026-109619: Use-after-free from stale global state retained between requests. A later request handled by the same PHP worker can access memory freed by an earlier request, leading to code execution or memory disclosure. CVSS v4.0: 9.2. 

Both vulnerabilities can be triggered before any application-level authentication takes place. The PHP project released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exploitation attempts against PHP have been publicly reported. QNAP has not received reports of exploitation targeting QNAP products. 

QNAP is currently investigating and fixing the affected products. This advisory will be updated as fixed versions become available. Until then, we strongly recommend that users apply the mitigations below. 

 

Affected products 

The following product versions are affected. Fixed versions will be listed here once released. 

Affected product	Status	Fixed version
QTS 6.1.0	Resolved	QTS 6.1.0.3656 build 20261023
QTS 5.2.11 and earlier	Resolved	QTS 5.2.11.3661 build 20261023
QuTS hero h6.1.0	Resolved	QuTS hero h6.1.0.3656 build 20261023
QuTS hero h6.0.x	Resolved	QuTS hero h6.0.2.3656 build 20261023
QuTS hero h5.2.11 and earlier	Resolved	QuTS hero h5.2.11.3661 build 20261023
QuTScloud c5.2.9 and earlier	Resolved	c5.2.9.3661 build 20261023
Notes Station 3 3.9.14 and earlier	Resolved	Notes Station 3 3.9.15
QNE (ADRA) 1.0.7 and earlier	Fixing	To be announced
QVR Surveillance 3.0.3 and earlier (ARM32 models)	Resolved	QVR Surveillance 3.0.3.1756
TVR OS 1.0.4 and earlier	Resolved	TVR OS 1.0.5

Mitigation 

Until fixed versions are available, the most effective protection is to keep the device off the internet. These steps reduce exposure but do not fully fix the vulnerabilities. 

The menu paths below apply to QTS, QuTS hero, and QuTScloud. For QNE (ADRA), QVR Surveillance, and TVR OS, apply the same network restrictions in steps 1 to 3 using your router or network firewall. 

 

1. Stop exposing the device to the internet. 

• Disable port forwarding for the NAS on your router, and disable UPnP on the router. 

• Go to myQNAPcloud > Auto Router Configuration and disable UPnP port forwarding. 

• Disable myQNAPcloud Link and unpublish services in myQNAPcloud > Publish Services if they are not required. 

 

2. Use a VPN for remote access. Connect through QVPN Service or your router's VPN instead of exposing web ports directly. 

 

3. Restrict access to trusted networks. 

• In QuFirewall, or in Control Panel > System > Security > Allow/Deny List if QuFirewall is not installed, allow access to the management ports (default 8080 and 443) and any custom ports you have configured only from trusted local subnets or VPN addresses. 

• Restricting access to the local network does not protect against attacks from local devices that are already compromised. 

 

4. Reduce PHP-based services you do not need. 

• In App Center, stop affected applications you do not currently need. Stopping is preferred over uninstalling for applications you will use again. 

• Before uninstalling any application, back up its settings and data (for example, Download Station tasks). 

• If you do not use the built-in web server, go to Control Panel > Applications > Web Server and disable it. 

• These steps do not protect the web administration interface; steps 1 to 3 remain the primary mitigations. 

 

5. Check for signs of compromise. Review QuLog Center for unexpected logins or access. Run Security Center and Malware Remover with the latest definitions. 

 

6. If you suspect compromise, disconnect the device from the network, change all passwords, and contact QNAP Support. 

 

PHP included in containers running on Container Station, or in third-party applications, is not covered by QNAP updates. Contact the image or application provider for a fixed version. 

 

After fixes are released, update immediately. We continue to recommend that you avoid exposing the device directly to the internet.

 

Recommendation 

QNAP will release updates for the affected products as soon as possible. We recommend regularly checking this advisory and keeping your system updated to the latest version. You can check update availability for your model on the product support status page. 

Updating QTS, QuTS hero, or QuTScloud (once fixes are available) 

1. Log in to QTS, QuTS hero, or QuTScloud as an administrator. 

2. Go to Control Panel > System > Firmware Update. 

3. Under Live Update, click Check for Update. The system downloads and installs the latest available update. 

You can also download the update from the QNAP Download Center and perform a manual update. 

Updating Notes Station 3 (once fixes are available) 

1. Log in to QTS or QuTS hero as an administrator. 

2. Open App Center and click the search icon. 

3. Type the application name and press Enter. 

4. Click Update, then click OK to confirm. 

Updating QNE (ADRA), QVR Surveillance, and TVR OS (once fixes are available) 

Download the latest firmware or application package for your model from the QNAP Download Center, then follow the update instructions in the product's user guide.