Synology NAS: update PHP, Mail Station and Calendar

If your office has a Synology NAS that runs Web Station, Mail Station or Synology Calendar, open Package Center and install the updates this week. Synology published advisory Synology-SA-26:14 on 22 October 2026 for the PHP2Shell flaws, rated critical. Fixed packages are available for every PHP version except PHP 7.3, which will not get a fix.

What happened

PHP2Shell is a pair of serious flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), fixed by the PHP team in October. They can let an attacker run code on a server that runs PHP websites. Synology's NAS uses PHP for its web packages, so it needed its own updates.

Synology says the PHP that is built into the NAS operating system is not exposed to outside attacks and the risk there is very low. The risk is in the PHP packages you install yourself, for example to run a website or an office app on the NAS with Web Station.

Which packages need an update

What to do

1. Log in to your NAS (DSM) as an administrator.
2. Open Package Center and go to Installed.
3. Update every PHP package, Mail Station and Synology Calendar that shows an update.
4. If a website on the NAS still uses PHP 7.3, switch it to a newer PHP version in Web Station, then test the site.
5. Remove PHP packages you no longer use.
6. If your NAS website or web app does not need to be reached from the internet, close it to the outside in your router or the DSM firewall.

If someone else installed your NAS, send them this page.

Older NAS models (updated 29 October 2026)

How SyncTech can help

If the NAS runs your company website or email only because there was nowhere else to put them, moving them to business web hosting or hosted business email means one less box to patch in the office.

Updated 29 October 2026: Synology now also releases the PHP fixes for older DSM versions that no longer get regular support. Fixed PHP packages are out for DSM 7.0, 7.1, 7.2, 7.3 and 7.4, and Synology planned a DSM 6.2 patch for 29 October. If your NAS runs a version older than DSM 6.2, Synology advises turning off the affected packages (such as Web Station, WordPress, phpMyAdmin, Mail Station and Calendar) and moving to a supported DSM version. Mail Station must be updated by hand; the other packages restart on their own after the PHP update.

Source and credit

We are sharing this advisory from Synology. This summary is written by Synctech in our own words.

• Synology-SA-26:14 PHP2Shell, Synology, 22 October 2026: https://www.synology.com/en-global/security/advisory/Synology_SA_26_14
• Synology Extends PHP2Shell Security Updates to End-of-Life DSM Versions, Synology, 22 October 2026, updated 28 October 2026: https://www.synology.com/en-global/company/news/article/php2shell

Retrieved 27 and 29 October 2026. Synology, DSM and Mail Station are trademarks of Synology Inc. PHP is a trademark of the PHP Group. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.