Critical PHP2Shell flaws also impact internet-exposed NAS devices and PHP-based Docker workloads
Major vendors are still releasing patches, leaving some Synology, QNAP, and other systems exposed
Researchers urge immediate updates, removal of public exposure, and VPN-only remote access
Websites and web servers are apparently not the only products affected by the php2shell vulnerability – Network Attached Storage (NAS) devices are at risk, too – and to make matters worse, some of the most popular manufacturers have not yet released a patch, despite the flaws being actively abused in the wild. Research by Apple Insider noted that the flaw also affects software maintained by NAS manufacturers, as well as applications running independently in Docker containers, with NAS devices that are reachable through the public internet also at risk. What’s particularly concerning is that some of the biggest NAS manufacturers have said to be working on a fix, but the work is yet to be done. Synology, for example, released a new security advisory saying PHP versions 7. 3 – 8. 4, Mail Station, and Synology Calendar are all affected and adding that it released updated PHP packages to address the flaws. Those running Synology NAS products should head over to the company’s Package Center and download archive and look for updated PHP 8. 2 and PHP 8. 4 packages. Twofold risk
The company also stressed that there is a difference between installed PHP packages and PHP components within DiskStation manager, and added that its built-in PHP isn’t exposed to the public internet, therefore most likely not at risk. Another major NAS manufacturer, QNAP, confirmed a wide range of affected products, including QTS 5. 2. 11 and older, QTS 6. 1. 9, QuTS hero and QuTScloud, and Note Station 3. It said it was currently working on a fix, but did not give a timeline on when the patch might become available. So far, there is no evidence of in-the-wild attacks, but the company does recommend removing the devices from the open internet, disabling unnecessary port forwarding, UPnP, and remote-access services…