Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix
Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices. If your files and backups are stored there, they're probably at risk. TerraMaster Network Attached Storage PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in. The PHP development team released security updates on October 21 for versions 8.2 through 8.5. The urgency isn't hypothetical, as Amazon detected an attempted exploit on October 17, four days before the vulnerabilities were publicly disclosed. For NAS owners, the threat affects both software maintained by the manufacturer and applications running independently in Docker containers. In either case, the risk of a remote attack depends on whether attackers can reach the vulnerable PHP service. Continue Reading on AppleInsider | Discuss on our Forums
What happened?
Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices. If your files and backups are stored there, they're probably at risk. TerraMaster Network Attached Storage PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in. The PHP development team released security updates on October 21 for versions 8.2 through 8.5. The urgency isn't hypothetical, as Amazon detected an attempted exploit on October 17, four days before the vulnerabilities were publicly disclosed. For NAS owners, the threat affects both software maintained by the manufacturer and applications running independently in Docker containers. In either case, the risk of a remote attack depends on whether attackers can reach the vulnerable PHP service. Continue Reading on AppleInsider | Discuss on our Forums
Story details
Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices.
If your files and backups are stored there, they're probably at risk.
TerraMaster Network Attached Storage PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services.
Why it matters
This page keeps Apple rumors separate from official updates, so readers can follow early reports without confusing them with confirmed announcements.