Synology warned on 29 October 2026 that ransomware operators are exploiting a vulnerability which the company patched in late 2024, targeting NASPriceAliExpress price devices that still run outdated DiskStation Manager releases. The attacks aim to encrypt stored data and demand payment. Synology is urging affected users to update DSM immediately and enable automatic updates.
Quick summary
- This is active exploitation of an already patched weakness, not a newly announced unpatched DSM zero-day.
- The warning points to Synology-SA-24:20, which includes a critical remote-code-execution flaw and fixes for DSM 6.2 through 7.2.2.
- A separate PHP2Shell issue affects optional PHP-dependent packages and requires Package Center updates.
- Owners should check DSM and package versions manually, reduce direct internet exposure and verify an independent backup.
The exploited weakness was fixed nearly two years ago
Synology has not attributed the campaign, named a ransomware family or published victim numbers. Its alert says the attackers are exploiting a vulnerability covered by Synology-SA-24:20. That advisory contains three flaws found around Pwn2Own 2024, including the critical CVE-2024-10441 remote-code-execution vulnerability. The new statement does not explicitly say which individual CVE is being used, so users should treat the complete advisory’s fixed-version thresholds as the minimum baseline.
| DSM branch | Synology-SA-24:20 fixed release |
|---|---|
| DSM 7.2.2 | 7.2.2-72806-1 or later |
| DSM 7.2.1 | 7.2.1-69057-6 or later |
| DSM 7.2 | 7.2-64570-4 or later |
| DSM 7.1 | 7.1.1-42962-7 or later |
| DSM 6.2 | 6.2.4-25556-8 or later |
These are historical minimums for this advisory, not recommended targets for October 2026. Install the newest release available for the exact NASAliExpress price model. Synology’s current DSM notes also warn that some updates are staged or may not trigger a notification, so relying solely on an on-screen prompt can leave a system behind.
PHP2Shell is a separate update job
Synology’s ransomware finding arose during an investigation into the separate PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated critical and can permit remote code execution through susceptible PHP packages. They are not the same older DSM flaw now being exploited.
Affected packages include Calendar, the third-party IDrive package, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. Synology Drive is not IDrive and is not included in that list. Synology has supplied PHP security updates for DSM 7.4 and 7.3, as well as end-of-life branches down to DSM 6.2. MailStation needs its own manual update; systems older than DSM 6.2 should disable the affected packages while moving to a supported DSM version.
What Synology owners should do now
- Open Control Panel → Update & Restore → DSM Update, check manually and install the latest release offered for the model.
- Open Package Center and update PHP plus every dependent package. Do not assume a DSM update also updates optional packages.
- Remove direct public access to DSM administration. Our remote NAS access guide compares VPN-based access with manufacturer relay services.
- Review administrator accounts, recent logins and unexpected file changes. Isolate a device and seek incident-response help if compromise is suspected.
- Confirm that at least one backup is outside the NAS and cannot be rewritten by a compromised administrator. The site’s 3-2-1 NAS backup plan and NAS-to-NAS backup guide cover practical options.
Snapshots stored on the same appliance remain useful for mistakes and limited corruption, but they are not a substitute for an independent recovery copy. This esp32.co.uk report reflects Synology’s notices as published on 30 October 2026.