Self-Hosted, Not Self-Exposed: Patching PHP2Shell on Your NAS

By Leo, woCyber — writing about local-first storage, private cloud and DIY home security.

Short answer: the search “unauthenticated rce nas no login” describes exactly what two PHP flaws did this October — an attacker needed no account, no password and no app permission, only a reachable web port. PHP patched them on 21 October 2026, on the 8.2, 8.3, 8.4 and 8.5 branches (8.2.35, 8.3.36, 8.4.27, 8.5.12) (php.net release archive). Your job tonight is not to read about it. It is to answer one question: is your NAS reachable from the internet right now?

Key takeaways

• CVE-2026-109618 and CVE-2026-109619 carry a CVSS v4.0 base score of 9.2 in QNAP’s advisory and allow remote code execution before authentication (QNAP advisory QSA-26-18, as summarised in QNAP’s 4 November 2026 announcement).
• Fixed NAS firmware has been shipping since 24 October 2026; QTS 6.1.0.3656 build 20261023 is one of the builds named by QNAP.
• Updating the firmware does not update PHP inside Container Station containers or third-party apps. That part is on you.
• Disabling the built-in web server does not close the admin interface. QNAP says so directly.
• A NAS with no port forwarding and no UPnP mapping was never the exposed one. Check that first — it takes two minutes and costs nothing.

Why is this one different from the usual NAS scare?

Because the flaw is not in a photo app or a sync client. It is in PHP itself — the runtime that serves the web interface, the login page and the API underneath it. QNAP’s own wording is that an attacker can execute code “before authentication”, and that exploit activity was observed in the wild before the vendor patch shipped (QNAP announcement, 4 November 2026).

Two consequences follow.

First, “I changed the default password” does nothing here. The flaw is reached before the login form is checked.

Second, “my NAS is local” is only true if you never opened it to the internet. Remote access turns a box on your shelf into a host on the public internet. It usually gets switched on for one concrete reason — uploading holiday photos from a hotel, checking a camera while travelling — and then stays on for years.

How do I check whether my NAS answers from outside?

Four checks, in this order. None of them require you to touch the NAS itself.

If all four are clean, you are in the low-risk group. Patch on your normal schedule and stop reading scare threads. If any one of them is live, treat it as urgent — not because this specific flaw is unstoppable, but because an unauthenticated RCE with a public path to it is the worst combination a storage box can offer.

One caveat on the fourth row: SMB and FTP were never designed to face the open internet. If you find either forwarded, the fix is to remove the forward, not to change the password.

What is the shortest safe patch path?

Five steps. Do them in this order and do not skip the fourth.

1. Back up first, offline. A patch that goes wrong on a storage box holding a single copy of your photos is a worse day than the vulnerability.
2. Close the exposure before you patch. Remove the port forward and disable UPnP. That single action removes the attack path while you update, and it costs you remote access for twenty minutes.
3. Update the firmware. QNAP lists QTS 6.1.0.3656 build 20261023, QTS 5.2.11.3661 build 20261023, QuTS hero h6.1.0.3656, h6.0.2.3656 and h5.2.11.3661, and QuTScloud c5.2.9.3661, all build 20261023. Notes Station 3 needs 3.9.15 separately (QNAP).
4. Verify the build number, not the “up to date” message. QNAP’s own guidance says the check-update screen showing nothing does not prove you are patched. Read the version string in the system status page.
5. Then reopen remote access the safe way — a VPN or an internal-only route, not a forwarded port.

If you run Synology instead, the equivalent advisory is SA-26:14, which lists fixed PHP, Calendar and Mail Station builds for DSM 7.0 through 7.1 and for DSM 6.2 (advisory summary, 2 November 2026). The principle is identical: the web stack underneath the interface needed replacing, not just the apps on top.

Why didn’t the firmware update fix everything?

Because a NAS runs more than one PHP. The system firmware replaces the PHP that serves the administration interface. It does not reach inside a container you installed, and it does not replace the PHP bundled with a third-party app.

QNAP states this explicitly: PHP inside Container Station containers or third-party applications is not updated with the firmware and must be obtained from whoever supplied it (QNAP announcement). It is also the sentence that decides whether your update closed anything at all.

Practical version: list your containers, find the ones with a web interface, and check their PHP base image. If a container publishes port 80 or 443 to the LAN and that LAN is reachable from outside, you have rebuilt the same problem in a smaller box.

What should you do if you cannot patch tonight?

Two moves, in this order. Remove the internet path, then reduce the surface you cannot remove.

Removing the path means port forwards off, UPnP off, vendor relay off. If you need remote access this week, a VPN back to your own network does the job without publishing a web port. That is the same advice QNAP gives, and it is the one mitigation that works across vendors.

The surface reduction is smaller and worth knowing: disabling the built-in web server does not protect the web administration interface. QNAP says so plainly. People assume those are the same service. They are not, and the assumption has cost people their data on more than one advisory.

What I would not do: leave the port open and rely on a long password. Length helps against guessing, and this class of flaw does not guess.

Our take, and what we don’t know

My take: most home NAS boxes were never exposed, and the people panicking loudest online are usually the ones running a forwarded port they set up three years ago and forgot. Check the four rows in the table before you spend a weekend reinstalling anything. Then patch, because the second-order risk — a box that is patched late but exposed — is the expensive one.

The counterintuitive part: an unpatched NAS behind your router is safer than a fully patched one with a forwarded port. Exposure decides the blast radius. Patch level decides what gets through. You need both, but if you can only fix one tonight, close the port.

And a fair word on local-first storage, since this is what we sell: keeping footage and files on your own hardware removes the cloud from the equation. It does not remove the network. A NAS security kit that records locally still sits on a LAN, and a LAN with a hole in it is a hole regardless of who owns the disks. Local is a data-ownership argument, not a security guarantee, and anyone selling it as one is overselling.

What we don’t know: how many home NAS units were actually compromised through these two CVEs. Vendors publish patch progress, not victim counts, and the gap between “exploited in the wild” and “how many” is where most of the anxiety lives.

Frequently asked questions

Is an unauthenticated RCE on a NAS worse than a ransomware infection?

It is often the way in. An unauthenticated remote code execution flaw lets an attacker run commands without an account; what they do next — encryption, exfiltration, quiet persistence — is a separate step.

Does changing the admin password protect against CVE-2026-109618?

No. The flaw is reached before authentication, so credentials are not part of the attack path. Patching the PHP stack is the fix.

How do I know my NAS firmware is really patched?

Read the full build number in the system status page and compare it with the vendor advisory. An empty update check is not evidence.

Can I keep using remote access after patching?

Yes, but through a VPN or an internal route rather than a forwarded port. Remote access and internet exposure are not the same thing, and only the second one is the risk.

The next step

Open your router’s port forwarding page. If nothing there points at your NAS, you have bought yourself time. If something does, remove it now and patch tonight — that order costs you nothing and closes the path the advisory is about.