QNAP has issued security advisory QSA-26-18 about two critical vulnerabilities in PHP, together called PHP2Shell. PHP is an open-source scripting language used in the web components of QNAP operating systems and several applications. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2.
According to QNAP, the first flaw is memory corruption during out-of-memory handling, triggered by a crafted HTTP request. The second is a use-after-free caused by stale global state retained between requests. Both can be triggered before application-level authentication, so unauthenticated remote attackers could execute arbitrary code on the device.
The PHP project released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. QNAP says exploitation attempts against PHP have been publicly reported, but it has received no reports of attacks on QNAP products. Fixed QNAP versions are still to be announced.
Until patches arrive, QNAP advises keeping the device off the internet. Disable port forwarding and UPnP, use a VPN for remote access and allow access to management ports only from trusted networks. Stop PHP-based applications you do not need, and check QuLog Center for unexpected logins.
If you suspect compromise, disconnect the device from the network, change all passwords and contact QNAP Support. PHP inside containers on Container Station or in third-party applications is not covered by QNAP updates, so ask the provider for a fixed version. Once fixes are released, update immediately.
Read qnap.com article for more information.
