PHP2Shell statement record · Platform
Status in the company's own words: mitigation only. Statement dated October 22, 2026 (V1.0).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.qnap.com, dated October 22, 2026 (V1.0). Source type: official page.
QSA-26-18 Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products
, severity Critical, status Fixing, fixed versions To be announced
. Affected: QTS 6.1.0, QTS 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x, h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, QuMagie 2.10.1 and earlier, Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32), TVR OS 1.0.4 and earlier. Until fixed versions are available, the most effective protection is to keep the device off the internet.
quoted from https://www.qnap.com/en/security-advisory/qsa-26-18. Mitigations: disable port forwarding, UPnP and myQNAPcloud Link, VPN only, restrict management ports, stop unneeded PHP apps, run Security Center and Malware Remover.
no status named
Yes—QNAP confirms affected products, but no product patches are listed as released as of October 23, 2026. Its official advisory QSA-26-18, published October 22, covers both CVE-2026-109618 and CVE-2026-109619 and remains marked “Fixing,” with fixed versions “To be announced.” The affected-products list includes: QTS: 6.1.0; 5.2.11 and earlier QuTS hero: h6.1.0; h6.0.x; h5.2.11 and earlier QuTScloud: c5.2.9 and earlier
no status named
Yes, QNAP is confirmed to be affected by PHP2Shell, but patches have not yet been released as of today (October 23, 2026). Here is a detailed breakdown: ⚠️ QNAP & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2
no status named
Yes. QNAP is affected by both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. QNAP’s advisory identifies affected products including QTS, QuTS hero, QuTScloud, TVR OS, and Note Station 3; for example, QTS 5.2.11 and earlier and Note Station 3.9.14 and earlier are listed as vulnerable. As of October 23, 2026, QNAP had not yet released patches for the affected products. QNAP
no status named
Yes, QNAP is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Affected QNAP Products According to QNAP's security advisory, the vulnerabilities impact multiple software versions and packages: QTS: 6.1.0, 5.2.11 and earlier QuTS hero: h6.1.0, h6.0.x, h5.2.11 and earlier QuTScloud: c5.2.9 and earlier QuMagie: 2.10.1 and earlier Note Station 3: 3.9.14 and earlier QNE (ADRA): 1.0.7 and earlier QVR
no status named
QNAP is assessing its product lines for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and has published an official statement detailing ongoing evaluations and mitigation guidance rather than a universal patch release status for all firmware packages. Overview of QNAP's Response Official Statement: QNAP released an advisory titled QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance. Current
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for QNAP reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
QNAP's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about QNAP and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy