PHP Vulnerability Responses by Company

Synology

Global cloud / infrastructure
Aliases / services
Synology / 群暉 / 群晖 / シノロジー / DiskStation Manager / DSM / Mail Station
Official website
https://www.synology.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

DSM PHP 7.4–8.4 add-on packages

Response status
Fixes available; install updates
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

NAS, storage and DSM applications.

Fixed builds: 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051 or later.

Scope: Availability does not confirm installation. PHP 7.3 and built-in OS PHP are separate.

What users should do

Update installed branches in Package Center; follow suspension and upgrade guidance for older DSM.

Official service URL

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence
  3. https://www.synology.com/en-global/security/advisoryhttps://www.synology.com/en-global/security/advisoryService and operation documentation

Synology Calendar

Response status
Fix available; install update
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Fix available in 3.0.4-21435 or later.

Scope: Applies to the Calendar package.

What users should do

Update through Package Center.

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence

MailStation

Response status
Fix available; manual update
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Fix available in 30000002.3.19-20333 or later.

Scope: Separate manual-update instruction for MailStation.

What users should do

Update MailStation manually in Package Center; a PHP update alone is insufficient.

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence

DSM PHP 7.3 package

Response status
No fix; assess migration
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

No fix will be provided because this branch is end of life.

Scope: Separate from fixes for PHP7.4 and later.

What users should do

Assess dependent apps and migrate to a supported patched environment; check older-DSM suspension guidance.

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence

Hyper Backup

Response status
Unaffected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October26 revision explicitly identifies Hyper Backup as unaffected.

Scope: Hyper Backup only.

What users should do

Check any other PHP-dependent packages separately.

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence

Built-in DSM PHP

Response status
No external exposure; fix planned
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

No external attack surface; exploitation risk assessed very low. A later DSM release is planned to patch it.

Scope: Does not mean PHP is absent or every device patched.

What users should do

Monitor DSM releases and separately update add-on PHP packages.

Source URLs

  1. Synology-SA-26:14: products and fixed releaseshttps://www.synology.com/en-global/security/advisory/Synology_SA_26_14Response evidence
  2. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence

Synology Drive

Response status
Unaffected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official statement explicitly identifies Synology Drive as unaffected.

Scope: Different product from third-party IDrive.

What users should do

Distinguish it from IDrive and other PHP-dependent packages.

Source URLs

  1. PHP2Shell scope and update guidancehttps://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20VulnerabilitiesResponse evidence
Related official sources
  1. Synology-SA-26:14: products and fixed releasesOfficial notice
  2. PHP2Shell scope and update guidanceOfficial notice

Comments