Greetings!,

For anyone running a Synology NAS, please read up on their latest security advisory Synology-SA-26:14 PHP2Shell.

There have been a considerable number of users reporting compromised NAS devices on r/synology over the past ~12 hours. It seems like most of the affected users were on outdated versions of DSM, not running updates on their packages, and/or being exposed to the open internet via QuickConnect, but I wanted to share here for the sake of visibility.

If you've already been impacted, search for "c3rb3r-rescue" on the open web and you should find a project that proports to help with this. I have not personally used it. (Auto-mod removed my last post where I submitted a hyperlink to it, because it incorrectly assumes it is project self-promotion and directed me to the weekly projects mega-thread.)

For the rest of Synology users who don't believe they've been impacted, you should take precautions IMMEDIATELY.

Combining the information some people have shared in r/synology, the following steps should help reduce your exposure:

1. Update DSM and your installed packages. Some users have reported that DSM was not prompting them for updates. Go manually check.
2. Remove packages you don't use.
3. Review how your NAS is accessible from the internet. Port forwarding, UPnP, reverse proxies, etc. If you don't need external access, disable it. Ideally, you should be using something like Tailscale to access.
4. Review your general security settings. Ensure MFA is enabled where supported, disable the default admin account, turn on immutable snapshots, and change default ports for anything that does need external access (Plex, for example). Ideally

Note to the security-conscious among us: It is true that one shouldn't have ports open, shouldn't have your NAS exposed to the internet, and should restrict external access to something like WireGuard or Tailscale... But Synology has marketed its products to general users as an easy-to-use solution, with features like QuickConnect, Photos, Drive, and other DSM applications making remote access relatively straightforward. I think this has given some users a false sense of security about what it actually means to have a NAS accessible outside their home network and needs to be called out for their sake.