Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices.
Summary
If your files and backups are stored there, they're probably at risk. TerraMaster Network Attached Storage PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in.
The PHP development team released security updates on October 21 for versions 8.2 through 8.5. The urgency isn't hypothetical, as Amazon detected an attempted exploit on October 17, four days before the vulnerabilities were publicly disclosed. For NAS owners, the threat affects both software maintained by the manufacturer and applications running independently in Docker containers.
In either case, the risk of a remote attack depends on whether attackers can reach the vulnerable PHP service.
KazaSec's take
Incidents like this rarely start with the headline event itself, they usually trace back to an exposed remote-access endpoint, an unpatched perimeter system, or a credential phished weeks earlier. The organizations that recover fastest are the ones that tested their defenses and their incident response plan before they needed them.
Coverage details
Related security advisories
Relevant from KazaSec
More security news
We help organizations find and fix the gaps before they make headlines.