Synology fixes critical PHP2Shell flaws: update PHP in Package Center
What it means for Australian buyersSynology rates the PHP2Shell vulnerabilities critical and has released fixed PHP packages for DSM 7.4, 7.3 and 7.2. If you run a PHP-based package such as Web Station or WordPress, update PHP through Package Center now.
Synology published security advisory Synology-SA-26:14 on 22 October 2026 for a set of PHP vulnerabilities known as PHP2Shell. It rates them critical: they can let a remote attacker run code through vulnerable PHP packages on DSM.
Synology says the impact is limited to systems running certain PHP-dependent packages: Calendar, IDrive, Joomla, KodExplorer, Mail Station, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. It has released PHP security updates for DSM 7.4, DSM 7.3 and DSM 7.2, and advises users of the affected packages to update PHP through Package Center immediately.
What to do
- If you use any of the packages above, open Package Center and update PHP.
- PHP 7.3 will not be fixed: Synology says it has reached end of life. Move anything that depends on it to a newer PHP version.
- On DSM versions earlier than 7.2, Synology recommends temporarily disabling the affected packages until you can update to a patched version.
Sources
- Synology-SA-26:14 PHP2Shell, Synology (accessed 24 Oct 2026)
- Synology statement on PHP2Shell vulnerabilities, Synology (accessed 24 Oct 2026)
Facts last checked 24 October 2026. Published 24 October 2026.