NASに重大な脆弱性「PHP2Shell」、QNAPなど一部メーカーは修正パッチ未提供 | XenoSpectrum

NASに重大な脆弱性「PHP2Shell」、QNAPなど一部メーカーは修正パッチ未提供 | XenoSpectrum

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page cz/news/xenospectrum/php2shell-nas-qnap-synology-patch-gap, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

XenoSpectrum (Japan, Japanese), 23 October: a major PHP2Shell flaw in NAS devices, with some makers, QNAP among them, having no fixed release as of 23 October. It says PHP is embedded in NAS operating systems that owners cannot always update, and compares vendors: Synology's advisory lists PHP 7.3 to 8.4 packages and apps such as Mail Station and Calendar as affected, rates the OS-embedded PHP's risk as very low and published fixes for affected packages (none for the end-of-life 7.3); Asustor's advisory AS-2026-023 says products where PHP was added to ADM are affected and recommends stopping the web server until a fix; QNAP's advisory QSA-26-18 says PHP is used by the OS's web functions and several apps, lists the affected products' status as 'Fixing' with no fix date, warns that stopping the built-in web server does not protect the web admin interface, and says containers and third-party apps are outside its updates. It also relays AppleInsider that TerraMaster was investigating an owner's report of PHP 7.4.33 on a web admin interface, and that QNAP reports no exploitation targeting its products. Defensive advice for owners is summarised.

> 何が起きた: PHP開発チームが10月21日に重大な脆弱性「PHP2Shell」を修正したが、一部のNASメーカーでは10月23日時点でも修正版が公開されていない。

_Curator's translation:_ "What happened: the PHP team fixed the critical PHP2Shell vulnerabilities on 21 October, but some NAS makers still had no fixed version published as of 23 October."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "NASに重大な脆弱性「PHP2Shell」、QNAPなど一部メーカーは修正パッチ未提供 | XenoSpectrum". Selected mechanically, not read by a person.

Capture notes

Language ja. Nothing in the page addresses an AI or hides text from a reader.