QNAP warns of critical PHP2Shell flaws in QTS and QuTS hero, with fixes still in progress
What it means for Australian buyersQNAP's advisory lists current QTS and QuTS hero releases and several QNAP apps as affected and rates the flaws critical. When we checked on 24 October its status was still "Fixing", so no fixed release was listed yet.
QNAP published advisory QSA-26-18 on 22 October 2026 for the PHP2Shell vulnerabilities. It rates them critical and says that, if exploited, they could allow unauthenticated remote attackers to run code on an affected device.
The affected products QNAP lists include QTS 6.1.0, QTS 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, and the QuMagie, Note Station 3, QNE (ADRA) and QVR Surveillance apps at the versions in the advisory. The advisory's status was "Fixing" when we checked on 24 October 2026.
What to do
- Check the advisory for the fixed versions and install them as soon as QNAP publishes them.
- Until then, the usual precaution applies: avoid exposing the NAS's web services and management interface directly to the internet.
Sources
- QSA-26-18: Vulnerabilities in PHP (PHP2Shell) affecting multiple QNAP products, QNAP (accessed 24 Oct 2026)
Facts last checked 24 October 2026. Published 24 October 2026.