Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3

Synology adds PHP2Shell fixes for older DSM, but not for PHP 7.3

31 October 2026: Synology has finished patching the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, across the packages it ships for DSM, adding fixed builds of Synology Calendar and Mail Station for DSM 6.2, 7.0 and 7.1 on 31 October. Both flaws are rated Critical (CVSS 3.1 base score 9.8) and allow remote code execution, and Synology's PHP 7.3 package will get no fix because that version has reached end of life.

Not yet independently verified. This rests on Synology's own advisory. We have found no report of the flaws being exploited against Synology devices, and Synology does not say whether automatic DSM updates install these package builds. We will update this when it can be confirmed, and remove this note.

How the advisory grew

Synology-SA-26:14 was first published on 22 October and has been revised three times since:

• 26 October: Hyper Backup added, as not affected;
• 29 October: PHP 7.4 builds for DSM 6.2, 7.0 and 7.1, and PHP 8.0 for DSM 7.0 and 7.1;
• 31 October: Synology Calendar and Mail Station for DSM 6.2, 7.0 and 7.1.

A NAS owner who read the advisory in its first week and found nothing for an older DSM release now has fixes to install. Both flaws come from upstream PHP: one in how out-of-memory errors abort a request and leave memory uninitialised, the other in global state that keeps pointing at freed request memory. We covered PHP's own fixed releases and CISA's addition of both CVEs to its exploited list.

Fixed builds by DSM release

Package	DSM 7.2 or above	DSM 7.0 to 7.1	DSM 6.2
Synology Calendar	3.0.4-21435	2.4.8-10948	2.4.8-0948
Mail Station	30000002.3.19-20333	30000002.3.19-10333	30000002.3.19-0333
PHP 7.4	7.4.33-0131	7.4.33-0122	7.4.33-0010
PHP 8.0	8.0.30-0122	8.0.30-0104	not listed

PHP 8.1, 8.2, 8.3 and 8.4 are fixed in 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 and 8.4.27-0051. PHP 7.3 is listed as Critical with "No fix will be provided as this version has reached end of life."

What Synology says about the risk

Synology's view is that the built-in PHP in DSM "is not exposed to external attack surfaces" and that the risk of exploitation is very low. The packages are a different matter. Mail Station and Calendar are web applications that many small offices publish to the internet so staff can reach mail and shared calendars from outside, and Web Station sites built on the PHP packages are often public too.

The practical step for an office running an older unit is to check Package Center for the builds above, and to move any site still on PHP 7.3 to 7.4 or 8.x, since Synology will not patch it. Units that cannot leave DSM 6.2 still get Calendar, Mail Station and PHP 7.4 fixes, but not PHP 8.0.

A second, smaller advisory

Synology also published Synology-SA-26:15 on 29 October for the Brotli flaw CVE-2026-111497. It rates the issue Moderate for its products, lists only Synology Chat Client as affected, and gives the fix status as ongoing with no mitigation yet.

Company profile on TrustList: Synology

Related on TrustList:

• Veeam fixes a critical authorization bypass in Backup & Replication 13
• Veeam fixes three code-execution flaws in its System Center pack
• Broadcom fixes 61 Brocade Fabric OS, SANnav and ASCG flaws

Sources

• Synology-SA-26:14 PHP2Shell (published 22 October, revision 4 of 31 October), 31 October 2026